CVE-2026-61588 Details
Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as `password` (the hash), privilege flags (e.g. `is_staff` / `is_superuser`), tokens, and other PII to the browser. Because exposing model objects to templates is a normal djust pattern, this could leak credentials/PII without the developer realizing the full object crossed the wire. This is fixed in djust 1.0.7. Model serialization applies a secure-by-default sensitive-field denylist (password/hash/token/secret-style fields and known privilege flags are withheld) with an identity-subset fallback. As a workaround, keep `Model` instances on `_private` attributes and expose only the specific fields needed, until patched.
A vulnerability in djust prior to version 1.0.7 allows for the exposure of sensitive data when a Django Model instance is assigned to a public view attribute. The library serialized the model data to the client without a denylist for sensitive fields, inadvertently sending password hashes, privilege flags (such as is_staff and is_superuser), tokens, and other personally identifiable information (PII) to the browser. This issue arises because exposing model objects to templates is a common practice in djust, potentially leading to unintentional data leaks.
Users can upgrade to djust version 1.0.7, which includes a secure-by-default sensitive-field denylist for model serialization. As an alternative, keep Model instances on private attributes and expose only the necessary fields until the upgrade is made.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/djust-org/djust/releases/tag/v1.0.7 | [email protected] | Release NotesVendor |
| https://github.com/djust-org/djust/security/advisories/GHSA-pvg3-6q9j-mj3x | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| djust-org djust | < 1.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |