CVE-2026-113731

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-113731
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113731.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-113731
Aliases
Published
2026-10-20T21:31:28Z
Modified
2026-10-21T10:45:42Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
Details

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py accepts an existing absolute template_path and reads it without restricting the resolved path to the project or configured template directories. A local MCP client can use the tool as a file existence and readability oracle and can obtain substrings that match the tool's dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern from files readable by the djust process. The maintainer assessment states that the MCP server communicates over local stdio as the same operating-system user and has no network listener, and the tool does not return arbitrary raw file contents. This issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113731.json"
}
References

Affected packages

Git / github.com/djust-org/djust

Affected ranges

Type
GIT
Repo
https://github.com/djust-org/djust
Events
Introduced
54b54d44a825619767fd224045a59adbed536460
Fixed
c615635e8bfdb2b333658dbc28ce4b793541cdb0
Introduced
de44fa0387807348082de560024c4dfa5aa8b3c6
Fixed
ac39a7cbb9c4affd799ea9c4ec6189b72ef58957
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9884f722bd4a8b2bb3f1ab3f62a4e26b237d6d19
Fixed
636a29b6a7207897a2dd78d8f4025e1fd62fb59e
Fixed
45a5045793ebe7c9c2df86b0ad34275af6822619
Fixed
744bccf699c65c815d9379b36236a7c5592a339b
Fixed
85eed7caaf620bdb08986f2f3bb79432c0d3d715
Fixed
a62caf6b4ef540ad688d4dfdfa407ff914c78728
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.9.0"
                },
                {
                    "fixed":  "1.0.10"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.1.0"
                },
                {
                    "fixed":  "1.1.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.2.0.dev0"
                },
                {
                    "fixed":  "1.2.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.3.0.dev0"
                },
                {
                    "fixed":  "1.3.0rc8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "45a5045793ebe7c9c2df86b0ad34275af6822619"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "744bccf699c65c815d9379b36236a7c5592a339b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "85eed7caaf620bdb08986f2f3bb79432c0d3d715"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "a62caf6b4ef540ad688d4dfdfa407ff914c78728"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.0.10",
            "range":  [
                {
                    "fixed":  "c615635e8bfdb2b333658dbc28ce4b793541cdb0"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v1.1.7",
            "range":  [
                {
                    "fixed":  "ac39a7cbb9c4affd799ea9c4ec6189b72ef58957"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v1.2.4",
            "range":  [
                {
                    "fixed":  "9884f722bd4a8b2bb3f1ab3f62a4e26b237d6d19"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v1.3.0rc8",
            "range":  [
                {
                    "fixed":  "636a29b6a7207897a2dd78d8f4025e1fd62fb59e"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.9.0
v0.9.1
v0.9.2
v0.9.2rc1
v0.9.2rc2
v0.9.3rc1
v0.9.3rc2
v0.9.4
v0.9.4rc1
v0.9.4rc2
v0.9.4rc3
v0.9.4rc5
v0.9.4rc6
v0.9.4rc7
v0.9.4rc8
v0.9.4rc9
v0.9.5
v0.9.5rc1
v0.9.5rc2
v0.9.5rc3
v0.9.5rc4
v0.9.6
v0.9.6rc1
v0.9.6rc2
v0.9.6rc3
v0.9.7
v0.9.7rc1
v0.9.7rc2
v0.9.7rc3
v1.*
v1.0.0
v1.0.0rc1
v1.0.0rc10
v1.0.0rc11
v1.0.0rc12
v1.0.0rc13
v1.0.0rc14
v1.0.0rc15
v1.0.0rc16
v1.0.0rc17
v1.0.0rc18
v1.0.0rc2
v1.0.0rc3
v1.0.0rc4
v1.0.0rc6
v1.0.0rc7
v1.0.0rc8
v1.0.0rc9
v1.0.1
v1.0.1rc1
v1.0.2
v1.0.2rc1
v1.0.2rc2
v1.0.2rc3
v1.0.3
v1.0.3rc1
v1.0.3rc2
v1.0.4
v1.0.4rc1
v1.0.5
v1.0.5rc1
v1.0.5rc2
v1.0.5rc3
v1.0.5rc4
v1.0.5rc5
v1.0.6
v1.0.6rc1
v1.0.6rc2
v1.0.6rc3
v1.0.7
v1.0.7rc1
v1.0.8
v1.0.8rc1
v1.0.9
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.6
v1.2.0rc1
v1.2.0rc2
v1.2.0rc3
v1.2.0rc4
v1.2.0rc5
v1.2.0rc6
v1.2.0rc7
v1.2.0rc8
v1.2.1
v1.2.3
v1.3.0rc4
v1.3.0rc5
v1.3.0rc6
v1.3.0rc7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113731.json"