GHSA-pvg3-6q9j-mj3x

Source

https://github.com/advisories/GHSA-pvg3-6q9j-mj3x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pvg3-6q9j-mj3x/GHSA-pvg3-6q9j-mj3x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pvg3-6q9j-mj3x

Aliases

CVE-2026-61588

Published

2026-09-16T22:02:49Z

Modified

2026-09-16T22:15:26Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

Details

Impact

When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password (the hash), privilege flags (e.g. is_staff / is_superuser), tokens, and other PII to the browser. Because exposing model objects to templates is a normal djust pattern, this could leak credentials/PII without the developer realizing the full object crossed the wire.

Patches

Fixed in djust 1.0.7. Model serialization applies a secure-by-default sensitive-field denylist (password/hash/token/secret-style fields and known privilege flags are withheld) with an identity-subset fallback.

Workarounds

Keep Model instances on _private attributes and expose only the specific fields needed, until patched.

Database specific

{
    "cwe_ids":  [
        "CWE-200",
        "CWE-359"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-16T22:02:49Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / djust

Package

Name: djust; View open source insights on deps.dev
Purl: pkg:pypi/djust

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.7

Affected versions

0.*

0.1.0

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.2.0

0.2.1

0.2.2

0.3.0

0.3.1

0.3.2

0.3.4

0.3.5

0.3.6

0.3.7

0.3.8

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.9.0

0.9.1

0.9.2

0.9.4

0.9.5

0.9.6

0.9.7

1.*

1.0.0rc1

1.0.0rc2

1.0.0rc3

1.0.0rc4

1.0.0rc6

1.0.0rc7

1.0.0rc8

1.0.0rc9

1.0.0rc10

1.0.0rc11

1.0.0rc12

1.0.0rc13

1.0.0rc14

1.0.0rc15

1.0.0rc16

1.0.0rc17

1.0.0rc18

1.0.0

1.0.1rc1

1.0.1

1.0.2rc1

1.0.2rc2

1.0.2rc3

1.0.2

1.0.3rc1

1.0.3rc2

1.0.3

1.0.4rc1

1.0.4

1.0.5rc1

1.0.5rc2

1.0.5rc3

1.0.5rc4

1.0.5rc5

1.0.5

1.0.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pvg3-6q9j-mj3x/GHSA-pvg3-6q9j-mj3x.json"