CVE-2026-61590 Details
Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.
A vulnerability in Djust prior to version 1.0.7 allows observability endpoints to be exposed over the network, revealing live view and session state. In a default configuration with DEBUG enabled and the localhost restriction middleware not installed, non-localhost clients could access application state and remotely invoke handlers via the 'eval_handler' method. This issue has been addressed in Djust version 1.0.7, which enforces the localhost restriction on all observability endpoints and limits access to 'eval_handler' by providing non-disclosing responses for gated requests.
Users can upgrade to Djust version 1.0.7 or later, ensure that DEBUG is set to False in production, and avoid exposing observability endpoints to untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/djust-org/djust/releases/tag/v1.0.7 | [email protected] | Release NotesVendor |
| https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| djust | < 1.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |