[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-61590":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":18,"cwes":19,"cpes":22,"technologies":23,"references":24,"score":27,"epss_score":28,"epss_percentile":29,"is_kev":30,"cisa_kev_date_added":31,"cisa_kev_due_date":31,"cisa_ssvc":32,"attack_mappings":42,"exploits":49},392267,"CVE-2026-61590","EUVD-2026-80744","djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view\u002Fsession state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.","2026-09-16T14:17:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":15,"userInteraction":17,"attackComplexity":15,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":15},"UNCHANGED","3.1",7.4,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N","NONE",true,[20,21],"CWE-668","CWE-306",[],[],[25,26],"https:\u002F\u002Fgithub.com\u002Fdjust-org\u002Fdjust\u002Freleases\u002Ftag\u002Fv1.0.7","https:\u002F\u002Fgithub.com\u002Fdjust-org\u002Fdjust\u002Fsecurity\u002Fadvisories\u002FGHSA-8g2f-g3gq-5rjv",0.57,0.00356,0.28199,false,null,{"timestamp":33,"automatable":34,"tech_impact":35,"exploitation":36,"cisa_decision":37,"cisa_remediation_timeline":41},"2026-09-16T15:49:33.322402Z","no","total","none",{"vector":38,"decision":39,"priority":40},"CISAv1\u002FE:N\u002FA:N\u002FT:T\u002FM:H\u002F2026-10-25T13:35:50.779023\u002F","track_star","medium","14D",[43],{"name":44,"source":45,"tactics":46,"technique_id":48},"Exploit Public-Facing Application","attack_vector",[47],"initial-access","T1190",[]]