CVE-2026-61591: djust state snapshot state injection vulnerability

CVE-2026-61591 · Severity: high · CVSS 8.1 · Published 2026-09-16

djust is a web framework for building interactive views. Applications that enable state snapshots are vulnerable to state tampering: an attacker can edit unsigned snapshot data in the page to inject false authorization claims (like admin privileges) or business-logic attributes (like account balances). An authenticated user with low privileges can escalate to higher privileges or modify sensitive application state. The fix signs state snapshots and rejects unsigned or forged ones.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61591 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61591 being exploited in the wild.
How severe is CVE-2026-61591?
High severity, with a CVSS score of 8.1, published 16 September 2026.
Which products and versions are affected?
djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.
Is there a fix for CVE-2026-61591?
Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61591 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61591?
Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djust (PyPI): upgrade to 1.0.7 or later
    pip install "djust>=1.0.7"

Technical details

The vulnerability is an insufficient verification of data authenticity (CWE-345) and improper control of object attribute modification (CWE-915). When state snapshots are enabled, djust embeds a state_json snapshot in the client page. On reconnect, this snapshot is restored as trusted view state without integrity verification. An attacker with low privileges can craft a reconnect frame containing modified state_json to inject arbitrary view attributes (e.g., flipping is_admin to True or changing account_id). The attack requires the attacker to be authenticated (network-accessible, low-privilege account required) but requires no user interaction. The vulnerability impacts confidentiality and integrity of authorization and business state. Fixed in djust 1.0.7 by adding cryptographic signing to state snapshots; unsigned or forged snapshots are now rejected on the back-navigation restore path.

Affected products

  • djust-org djust < 1.0.7

Identifiers

  • CVE-2026-61591
  • GHSA-c67v-vqrp-m5wj
  • PYSEC-2026-4040

Timeline

  • 2026-06-22: disclosed: Advisory published by johnrtipton
  • 2026-06-22: patched: Fixed in djust 1.0.7
  • 2026-09-16: advisory: GitHub Advisory Database updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.