CVE-2026-61590

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7

Description Observability endpoints expose live view/session state and a remote method-invocation surface via the eval handler function. In configurations where DEBUG is enabled and the optional localhost restriction middleware is not installed, clients from non-localhost addresses can read live application state and invoke handlers remotely.

Recommendations Update to version 1.0.7. Set DEBUG=False in production environments. Restrict access to observability endpoints to prevent exposure to untrusted networks.