PYSEC-2026-4040

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/djust/PYSEC-2026-4040.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-4040

Aliases

Published

2026-10-01T16:38:31Z

Modified

2026-10-01T17:45:03Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Details

Impact

For views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).

Patches

Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.

Workarounds

Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

References

Affected packages

PyPI / djust

Package

Name: djust; View open source insights on deps.dev
Purl: pkg:pypi/djust

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.7

Affected versions

0.*

0.1.0

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.2.0

0.2.1

0.2.2

0.3.0

0.3.1

0.3.2

0.3.4

0.3.5

0.3.6

0.3.7

0.3.8

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.9.0

0.9.1

0.9.2

0.9.4

0.9.5

0.9.6

0.9.7

1.*

1.0.0rc11

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/djust/PYSEC-2026-4040.yaml"