Executive brief
djust is a Python web framework for building real-time interactive views over WebSocket and SSE. An unauthenticated attacker can send a specially crafted mount request to force the server to import and execute arbitrary Python modules that are already installed on the system. This allows an attacker to trigger unintended code execution via module import side effects, crash the service with expensive imports, or discover what modules are installed on the server.
Technical details
The vulnerability is an unsafe reflection flaw (CWE-470) in the view-mount resolution logic across three attack surfaces: WebSocket `handle_mount` in websocket.py, SSE mount handling in sse.py, and `ViewRuntime.dispatch_mount` / `_instantiate_view` in runtime.py. All three sinks accept a client-supplied `view` parameter containing a dotted Python module path, which is imported via `__import__()` without prior validation. The LIVEVIEW_ALLOWED_MODULES allowlist that should gate imports is fail-open (disabled when unset, the framework default) and uses loose `startswith` matching, allowing namespace traversal. Since `__import__()` is called before subclass-type checking and before per-view authentication, an unauthenticated WebSocket/SSE client can import any importable module and cause its top-level code (e.g., module-level statements, `__init__.py` code, dependency initialization) to execute. The fix in 1.0.7 introduces a fail-closed resolution gate that only allows imports if the module is already loaded in `sys.modules` or explicitly whitelisted with exact module-segment-boundary matching, and this gate runs before `__import__()` at all three sinks.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed: Security advisory published by djust-org/djust
- 2026-06-22: patched: Fix released in version 1.0.7
- 2026-09-16: advisory: GitHub Advisory Database entry created