CVE-2026-61599: Unauthenticated Arbitrary Module Import in djust Framework
Vulnerability ID: CVE-2026-61599
CVSS Score: 8.8
Published: 2026-09-16
A critical unauthenticated arbitrary module import vulnerability in the djust framework before version 1.0.7 allows remote attackers to execute arbitrary code by exploiting unsafe Python reflection during LiveView connection mounting.
TL;DR
Unauthenticated remote attackers can execute arbitrary code on djust-enabled Django applications via crafted WebSocket payloads exploiting unsafe dynamic Python imports.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-470
- Attack Vector: Network
- CVSS v4.0 Score: 8.8 (High)
- EPSS Score: Not Assigned
- Exploit Status: PoC / Conceptual
- CISA KEV Status: Not Listed
Affected Systems
- djust
-
djust: < 1.0.7 (Fixed in:
1.0.7)
Exploit Details
- GitHub Security Advisory: Exploit mechanism analysis and mitigation guide detailing the websocket message payload pattern.
Mitigation Strategies
- Upgrade djust to version 1.0.7 or later to implement strict, fail-closed view resolution validation.
- Manually define the LIVEVIEW_ALLOWED_MODULES configuration setting with precise allowed modules to restrict the attack surface.
Remediation Steps:
- Run 'pip install --upgrade djust' or update your project's requirements file to specify djust>=1.0.7.
- Verify the installation of djust version 1.0.7 using 'pip show djust'.
- In your Django settings.py file, define LIVEVIEW_ALLOWED_MODULES as a list of exact module paths containing authorized views.
- Restart all running Django application server instances to apply the configuration updates.
References
Read the full report for CVE-2026-61599 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)