CVE-2026-61597

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Version 1.0.7 contains a fix. As a workaround, do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.

• CWE-79

• https://github.com/djust-org/djust/releases/tag/v1.0.7
• https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61591djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61592djust provides Phoenix LiveView-style reactive server-side r…7.4
• CVE-2026-61593djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61594djust provides Phoenix LiveView-style reactive server-side r…9.1
• CVE-2026-61595djust provides Phoenix LiveView-style reactive server-side r…7.7
• CVE-2026-61596djust provides Phoenix LiveView-style reactive server-side r…7.1
• CVE-2026-61598djust provides Phoenix LiveView-style reactive server-side r…7.1
• CVE-2026-61599djust provides Phoenix LiveView-style reactive server-side r…8.8
• CVE-2026-6160A vulnerability was found in code-projects Simple ChatBox 1.…5.5
• CVE-2026-61605Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61606Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61607Grav API Plugin is a RESTful API for Grav CMS that provides …4.6