CVE-2026-61598: Remote State Modification via Mass Assignment in djust Framework

Vulnerability ID: CVE-2026-61598
CVSS Score: 7.1
Published: 2026-09-16

CVE-2026-61598 is a high-severity mass-assignment vulnerability (CWE-915) affecting the Python package djust prior to version 1.0.7. An authenticated client can supply arbitrary parameter names to modify public view attributes on the server via WebSocket events, leading to unauthorized state manipulation, authorization bypass, or price tampering.

TL;DR

A mass-assignment vulnerability in djust allows authenticated clients to modify arbitrary public server-side view attributes via crafted WebSocket payloads.

Technical Details

• CWE ID: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
• Attack Vector: Network
• CVSS v4.0: 7.1
• Exploit Status: None / No Public PoC
• CISA KEV Status: Not Listed
• Remediation: Upgrade to 1.0.7 or declare explicit allowed_model_fields

Affected Systems

• Applications implementing python package djust versions < 1.0.7 on Django
• djust: < 1.0.7 (Fixed in: 1.0.7)

Mitigation Strategies

• Upgrade djust to version 1.0.7 or higher to transition to a safe-by-default posture.
• Manually override allowed_model_fields on Legacy LiveViews when patching is delayed.
• Keep sensitive data isolated in private properties or session storage.

Remediation Steps:

1. Run your dependency checker or pip list to verify the current djust version.
2. Upgrade using the command: pip install --upgrade djust>=1.0.7
3. Identify instances of dynamic template bindings and configure allowed_model_fields manually if required.
4. Refactor public LiveView attributes containing authorization or transactional variables to prevent state manipulation.

References

• GitHub Security Advisory GHSA-cc7c-9jff-58wj
• djust Release Notes v1.0.7
• CVE-2026-61598 Record

Read the full report for CVE-2026-61598 on our website for more details including interactive diagrams and full exploit analysis.