CVE-2026-61599

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling `__import__(module_path, ...)`. The module is imported — running its top-level code (import side effects) — before the framework checks that the resolved object is a `LiveView` subclass and before any per-view authentication. The `LIVEVIEW_ALLOWED_MODULES` allowlist that should contain this is fail-open (`if allowed_modules:` — skipped when the setting is unset, the framework default) and uses loose `startswith` matching. An unauthenticated WebSocket client (the WS handshake does not require auth; per-view auth runs only after import + instantiate) can therefore send a `mount` / `live_redirect_mount` / `url_change` frame (or an SSE mount) with `view = "<any.importable.module>.AnyName"` and cause the server to import — and execute the top-level code of — any importable Python module by name. Version 1.0.7 fixes the issue with a fail-closed resolution gate (`djust._view_resolution.is_view_import_allowed`): a client view path resolves only if (a) its module is already loaded (`sys.modules` — so resolving runs no new code; URL-routed views loaded by URLconf at startup keep working with zero config) or (b) it matches `LIVEVIEW_ALLOWED_MODULES` on a module-segment boundary (explicit opt-in for lazily-imported views). The gate runs before `__import__` at all three sinks (+ defense-in-depth inside `_instantiate_view`). As a workaround, set `LIVEVIEW_ALLOWED_MODULES` to the narrow list of modules that contain your mountable LiveView classes. (Note: pre-patch the allowlist is `startswith`-matched and the import still precedes the subclass check, so this is mitigation, not a complete fix.)

• CWE-470

• https://github.com/djust-org/djust/releases/tag/v1.0.7
• https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61593djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61594djust provides Phoenix LiveView-style reactive server-side r…9.1
• CVE-2026-61595djust provides Phoenix LiveView-style reactive server-side r…7.7
• CVE-2026-61596djust provides Phoenix LiveView-style reactive server-side r…7.1
• CVE-2026-61597djust provides Phoenix LiveView-style reactive server-side r…5.1
• CVE-2026-61598djust provides Phoenix LiveView-style reactive server-side r…7.1
• CVE-2026-6160A vulnerability was found in code-projects Simple ChatBox 1.…5.5
• CVE-2026-61605Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61606Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61607Grav API Plugin is a RESTful API for Grav CMS that provides …4.6
• CVE-2026-61608SolidInvoice is an open-source invoicing platform. Prior to …6.8
• CVE-2026-61609Pterodactyl is a free, open-source game server management pa…7.5