# CVE-2026-61593: djust Server-Sent-Events cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-61593-djust-server-sent-events-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61593 · Severity: high · CVSS 8.1 · Published 2026-09-16

djust is a web framework library that supports real-time communication between clients and servers using Server-Sent Events (SSE). A vulnerability in its SSE transport allows an attacker to forge requests from a victim's browser to trigger unauthorized state-changing actions in the victim's djust session. An attacker can accomplish this by embedding malicious content on a cross-origin website that, when visited by a victim with active authentication cookies, silently forces the victim's browser to establish a djust session and execute commands as the victim.

Technologies: [djust (PyPI)](https://junglewise.ai/threats/technologies/djust). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-61593 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61593 being exploited in the wild.

**How severe is CVE-2026-61593?** High severity, with a CVSS score of 8.1, published 16 September 2026.

**Which products and versions are affected?** djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.

**Is there a fix for CVE-2026-61593?** Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61593 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61593?** Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- djust (PyPI): upgrade to 1.0.7 or later

  ```sh
  pip install "djust>=1.0.7"
  ```


## Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF) in djust's Server-Sent-Events (SSE) transport layer. The root cause is the lack of origin validation on SSE endpoints combined with exemption from CSRF protection. An attacker can exploit this by: (1) hosting malicious HTML on an attacker-controlled domain that makes cross-origin requests to a victim's djust application; (2) leveraging the fact that SSE GET endpoints lack Origin checks and POST endpoints are @csrf_exempt; (3) sending JSON payloads as text/plain to bypass Content-Type restrictions and CORS preflight requirements. When a victim with valid authentication cookies visits the malicious site, their browser silently establishes an SSE session and POSTs commands to state-changing event handlers. The session_id is client-chosen and validated only for UUID format, offering no CSRF token protection. Fixed in version 1.0.7 by adding Origin validation against ALLOWED_HOSTS on all three SSE endpoints and requiring Content-Type: application/json on POST endpoints.

## Affected products

- djust-org djust < 1.0.7

## Identifiers

- CVE-2026-61593
- GHSA-pg97-jvmf-qfvc
- PYSEC-2026-4044

## Timeline

- 2026-09-16: disclosed: Advisory published to GitHub Advisory Database
- 2026-06-22: patched: Fix released in djust 1.0.7

## References

- [https://github.com/djust-org/djust/security/advisories/GHSA-pg97-jvmf-qfvc](https://github.com/djust-org/djust/security/advisories/GHSA-pg97-jvmf-qfvc)
- [https://github.com/djust-org/djust/releases/tag/v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)
- [https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-pg97-jvmf-qfvc](https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-pg97-jvmf-qfvc)

## Related threats

- [djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.](https://junglewise.ai/threats/cve-2026-113731-djust-provides-phoenix-liveview-style-reactive-server-side)
- [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf)
- [djust multiple template-layer cross-site scripting flaws](https://junglewise.ai/threats/djust-six-template-layer-defects-emit-attacker-controlled-markup-54f3f871)
- [djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse)
- [djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor)