CVE-2026-61588: Sensitive Data Exposure via Over-Serialization in djust Framework
Vulnerability ID: CVE-2026-61588
CVSS Score: 6.5
Published: 2026-09-16
A sensitive data exposure vulnerability exists in the djust framework before version 1.0.7. When serializing Django models to public view attributes, the framework fails to filter out sensitive fields such as passwords, privilege flags, and private tokens, leading to over-serialization and exposure of sensitive records to the client browser.
TL;DR
djust prior to 1.0.7 leaks sensitive database fields (such as user password hashes and administrator flags) to the browser when Django models are bound directly to public LiveView attributes.
Technical Details
- CWE ID: CWE-200, CWE-359
- Attack Vector: Network
- CVSS v3.1: 6.5 (Medium)
- EPSS Score: Not indexed
- Impact: High Confidentiality Exposure
- Exploit Status: None (Theoretical)
- KEV Status: Not listed
Affected Systems
- djust framework (Python package)
-
djust: < 1.0.7 (Fixed in:
1.0.7)
Mitigation Strategies
- Upgrade to djust version 1.0.7 or later to apply built-in floor denylists and customizable serialization controls.
- Prefix internal view attributes with a leading underscore to prevent client-side serialization.
- Explicitly serialize only required primitive fields to public attributes instead of assigning complete Django Model instances.
Remediation Steps:
- Run 'pip install --upgrade djust>=1.0.7' to update the package dependency.
- Identify all djust LiveView classes in the codebase that assign models to self.
- Change public attributes (e.g., self.user) to private attributes (e.g., self._user) or define 'djust_exclude_fields' / 'djust_serializable_fields' inside your Django models.
References
Read the full report for CVE-2026-61588 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)