CVE-2026-61593: djust Server-Sent-Events cross-site request forgery

CVE-2026-61593 · Severity: high · CVSS 8.1 · Published 2026-09-16

djust is a web framework library that supports real-time communication between clients and servers using Server-Sent Events (SSE). A vulnerability in its SSE transport allows an attacker to forge requests from a victim's browser to trigger unauthorized state-changing actions in the victim's djust session. An attacker can accomplish this by embedding malicious content on a cross-origin website that, when visited by a victim with active authentication cookies, silently forces the victim's browser to establish a djust session and execute commands as the victim.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61593 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61593 being exploited in the wild.
How severe is CVE-2026-61593?
High severity, with a CVSS score of 8.1, published 16 September 2026.
Which products and versions are affected?
djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.
Is there a fix for CVE-2026-61593?
Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61593 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61593?
Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djust (PyPI): upgrade to 1.0.7 or later
    pip install "djust>=1.0.7"

Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF) in djust's Server-Sent-Events (SSE) transport layer. The root cause is the lack of origin validation on SSE endpoints combined with exemption from CSRF protection. An attacker can exploit this by: (1) hosting malicious HTML on an attacker-controlled domain that makes cross-origin requests to a victim's djust application; (2) leveraging the fact that SSE GET endpoints lack Origin checks and POST endpoints are @csrf_exempt; (3) sending JSON payloads as text/plain to bypass Content-Type restrictions and CORS preflight requirements. When a victim with valid authentication cookies visits the malicious site, their browser silently establishes an SSE session and POSTs commands to state-changing event handlers. The session_id is client-chosen and validated only for UUID format, offering no CSRF token protection. Fixed in version 1.0.7 by adding Origin validation against ALLOWED_HOSTS on all three SSE endpoints and requiring Content-Type: application/json on POST endpoints.

Affected products

  • djust-org djust < 1.0.7

Identifiers

  • CVE-2026-61593
  • GHSA-pg97-jvmf-qfvc
  • PYSEC-2026-4044

Timeline

  • 2026-09-16: disclosed: Advisory published to GitHub Advisory Database
  • 2026-06-22: patched: Fix released in djust 1.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.