DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61591: CVE-2026-61591: State Snapshot Injection and Mass Assignment in djust Framework

#security #cve #cybersecurity

CVE-2026-61591: State Snapshot Injection and Mass Assignment in djust Framework

Vulnerability ID: CVE-2026-61591
CVSS Score: 8.1
Published: 2026-09-16

CVE-2026-61591 is a high-severity state injection and authorization bypass vulnerability affecting the djust framework's opt-in State Snapshot feature. Prior to version 1.0.7, the framework restored public view state snapshots returned from the client browser during back-navigation without validating their cryptographic authenticity or integrity. This flaw allows malicious clients to manipulate serialized JSON payloads to inject unauthorized properties, leading to mass assignment (CWE-915) and privilege escalation. Version 1.0.7 addresses this issue by introducing HMAC cryptographic signatures bound to both the view configuration and the user's session identifier.

TL;DR

Unsigned client-side state snapshots in the djust framework allow remote authenticated attackers to execute arbitrary state injection and mass assignment via tampered WebSocket frames, leading to full privilege escalation. This has been resolved in version 1.0.7 through cryptographic HMAC signatures.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-345, CWE-915
  • Attack Vector: Network
  • CVSS v3.1 Score: 8.1 (High)
  • Exploit Status: Proof-of-Concept / Conceptual
  • KEV Status: Not Listed
  • Affected Component: State Snapshot Feature (live_redirect_mount)

Affected Systems

  • djust framework library
  • djust: < 1.0.7 (Fixed in: 1.0.7)

Code Analysis

Commit: f395b0d

Fix insecure state-snapshot deserialization vulnerability in LiveView restore paths via secure HMAC signatures.

Exploit Details

  • GitHub Advisory: Conceptual proof-of-concept testing suite included within the djust security regression suite verifying snapshot signature mismatches.

Mitigation Strategies

  • Upgrade the djust framework library to version 1.0.7 or higher to implement cryptographic HMAC signatures on all state snapshots.
  • Disable the state snapshot feature globally or on individual views if upgrade cycles cannot be executed immediately.
  • Remove privilege and authorization state variables from the public scope of LiveView classes to prevent state manipulation.

Remediation Steps:

  1. Step 1: Inspect the current djust package version in the project requirements.
  2. Step 2: Execute pip install --upgrade djust>=1.0.7 to pull the security update.
  3. Step 3: Update local configuration files and ensure DJUST_STATE_SNAPSHOT_MAX_AGE is defined if custom TTL is required.
  4. Step 4: Re-verify application flows and confirm state restoration works securely with cryptographic signatures.

References

Read the full report for CVE-2026-61591 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)