GHSA-c67v-vqrp-m5wj

Source

https://github.com/advisories/GHSA-c67v-vqrp-m5wj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c67v-vqrp-m5wj/GHSA-c67v-vqrp-m5wj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c67v-vqrp-m5wj

Aliases

CVE-2026-61591

Published

2026-09-16T21:56:12Z

Modified

2026-09-16T22:15:26Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Details

Impact

For views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).

Patches

Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.

Workarounds

Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Database specific

{
    "cwe_ids":  [
        "CWE-345",
        "CWE-915"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-16T21:56:12Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

PyPI / djust

Package

Name: djust; View open source insights on deps.dev
Purl: pkg:pypi/djust

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.7

Affected versions

0.*

0.1.0

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.2.0

0.2.1

0.2.2

0.3.0

0.3.1

0.3.2

0.3.4

0.3.5

0.3.6

0.3.7

0.3.8

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.9.0

0.9.1

0.9.2

0.9.4

0.9.5

0.9.6

0.9.7

1.*

1.0.0rc1

1.0.0rc2

1.0.0rc3

1.0.0rc4

1.0.0rc6

1.0.0rc7

1.0.0rc8

1.0.0rc9

1.0.0rc10

1.0.0rc11

1.0.0rc12

1.0.0rc13

1.0.0rc14

1.0.0rc15

1.0.0rc16

1.0.0rc17

1.0.0rc18

1.0.0

1.0.1rc1

1.0.1

1.0.2rc1

1.0.2rc2

1.0.2rc3

1.0.2

1.0.3rc1

1.0.3rc2

1.0.3

1.0.4rc1

1.0.4

1.0.5rc1

1.0.5rc2

1.0.5rc3

1.0.5rc4

1.0.5rc5

1.0.5

1.0.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c67v-vqrp-m5wj/GHSA-c67v-vqrp-m5wj.json"