CVE-2026-61588

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as `password` (the hash), privilege flags (e.g. `is_staff` / `is_superuser`), tokens, and other PII to the browser. Because exposing model objects to templates is a normal djust pattern, this could leak credentials/PII without the developer realizing the full object crossed the wire. This is fixed in djust 1.0.7. Model serialization applies a secure-by-default sensitive-field denylist (password/hash/token/secret-style fields and known privilege flags are withheld) with an identity-subset fallback. As a workaround, keep `Model` instances on `_private` attributes and expose only the specific fields needed, until patched.

• CWE-200
• CWE-359

• https://github.com/djust-org/djust/releases/tag/v1.0.7
• https://github.com/djust-org/djust/security/advisories/GHSA-pvg3-6q9j-mj3x

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6156A security vulnerability has been detected in Totolink A7100…9.8
• CVE-2026-61560`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.8
• CVE-2026-61568`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6157A vulnerability was detected in Totolink A800R 4.1.2cu.5137_…8.8
• CVE-2026-61574authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-6158A flaw has been found in Totolink N300RH 6.1c.1353_B20190305…7.3
• CVE-2026-61589djust provides Phoenix LiveView-style reactive server-side r…6.3
• CVE-2026-6159A vulnerability has been found in code-projects Simple ChatB…4.3
• CVE-2026-61590djust provides Phoenix LiveView-style reactive server-side r…7.4
• CVE-2026-61591djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61592djust provides Phoenix LiveView-style reactive server-side r…7.4
• CVE-2026-61593djust provides Phoenix LiveView-style reactive server-side r…8.1