CVE-2026-61599

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7

Description djust allows an unauthenticated WebSocket or SSE client to trigger the import and execution of the top-level code of any importable Python module. This occurs because the live transport resolves the LiveView to mount using a client-supplied dotted path via the import () function before performing authentication or verifying if the object is a LiveView subclass. The LIVEVIEW ALLOWED MODULES allowlist is fail-open by default and uses loose startswith matching, enabling an attacker to send a mount, live redirect mount, or url change frame with a malicious view variable. This can lead to server-side execution of arbitrary import-time side effects, denial of service through import bombs, and module enumeration. The issue affects the handle mount function in python/djust/websocket.py, the ViewRuntime.dispatch mount and instantiate view functions in python/djust/runtime.py, and the SSE mount in python/djust/sse.py.

Recommendations Update djust to version 1.0.7. As a temporary mitigation, set LIVEVIEW ALLOWED MODULES to a narrow list of modules containing mountable LiveView classes.