CVE-2026-125112

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name...

CVE-2026-125112

The djust framework (a Django reactive server-side rendering tool) is vulnerable to Stored or Reflected Cross-Site Scripting (XSS) in versions prior to 1.0.10 and 1.1.2 . The root cause is that the context safety channel is keyed by variable name rather than value; if a view marks a name as safe ...

EUVD-2026-120493

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name...

CVE-2026-125112: djust-org djust: djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name...