GHSA-pg97-jvmf-qfvc

Suggest an improvement
Source
https://github.com/advisories/GHSA-pg97-jvmf-qfvc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pg97-jvmf-qfvc/GHSA-pg97-jvmf-qfvc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pg97-jvmf-qfvc
Aliases
  • CVE-2026-61593
Published
2026-09-16T15:45:03Z
Modified
2026-09-16T16:00:46Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
Details

Impact

The SSE client→server POST endpoints are @csrf_exempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with credentials: include to fire state-changing event handlers as the victim. The URL session_id is client-chosen (validated only for UUID format), so it is not a CSRF token, and a JSON body sent as text/plain is a CORS simple request with no preflight.

Patches

Fixed in djust 1.0.7. All three SSE endpoints validate the request Origin against ALLOWED_HOSTS (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require Content-Type: application/json (415 otherwise), closing the text/plain simple-request bypass.

Workarounds

Disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.

Database specific 
{
    "cwe_ids": [
        "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-16T15:45:03Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

PyPI / djust

Package

Name
djust
View open source insights on deps.dev
Purl
pkg:pypi/djust

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.7

Affected versions

0.*
0.1.0
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.9.0
0.9.1
0.9.2
0.9.4
0.9.5
0.9.6
0.9.7
1.*
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.0.0rc4
1.0.0rc6
1.0.0rc7
1.0.0rc8
1.0.0rc9
1.0.0rc10
1.0.0rc11
1.0.0rc12
1.0.0rc13
1.0.0rc14
1.0.0rc15
1.0.0rc16
1.0.0rc17
1.0.0rc18
1.0.0
1.0.1rc1
1.0.1
1.0.2rc1
1.0.2rc2
1.0.2rc3
1.0.2
1.0.3rc1
1.0.3rc2
1.0.3
1.0.4rc1
1.0.4
1.0.5rc1
1.0.5rc2
1.0.5rc3
1.0.5rc4
1.0.5rc5
1.0.5
1.0.6rc1
1.0.6rc2
1.0.6rc3
1.0.6
1.0.7rc1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pg97-jvmf-qfvc/GHSA-pg97-jvmf-qfvc.json"