# CVE-2026-113731: djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.

Source: https://junglewise.ai/threats/cve-2026-113731-djust-provides-phoenix-liveview-style-reactive-server-side  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113731 · Severity: low · CVSS 3.3 · Published 2026-10-20

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py accepts an existing absolute template_path and reads it without restricting the resolved path to the project or configured template directories. A local MCP client can use the tool as a file existence and readability oracle and can obtain substrings that match the tool's dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern from files readable by the djust process. The maintainer assessment states that the MCP server communicates over local stdio as the same operating-system user and has no network listener, and the tool does not return arbitrary raw file contents. This issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.

Technologies: [djust (PyPI)](https://junglewise.ai/threats/technologies/djust). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-113731 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113731 being exploited in the wild.

**How severe is CVE-2026-113731?** Low severity, with a CVSS score of 3.3, published 20 October 2026.

**Which products and versions are affected?** djust (PyPI) >= 0.9.0, <= 1.0.9, ECOSYSTEM:introduced=0.9.0,fixed=1.0.10.

**Is there a fix for CVE-2026-113731?** Yes. djust (PyPI): upgrade to 1.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-113731?** Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- djust (PyPI): upgrade to 1.0.10 or later

  ```sh
  pip install "djust>=1.0.10"
  ```


## Affected products

- djust (PyPI) >= 0.9.0, <= 1.0.9, ECOSYSTEM:introduced=0.9.0,fixed=1.0.10

## Identifiers

- CVE-2026-113731
- GHSA-r57g-mc79-8hj2

## Related threats

- [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf)
- [djust multiple template-layer cross-site scripting flaws](https://junglewise.ai/threats/djust-six-template-layer-defects-emit-attacker-controlled-markup-54f3f871)
- [djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse)
- [djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor)
- [djust host header omission in WebSocket tenant resolution](https://junglewise.ai/threats/cve-2026-61589-djust-host-header-omission-in-websocket-tenant-resolution)