djust CVE-2026-113731

Exploitation requires an active local MCP (Model Context Protocol) client session connected over stdio to the djust MCP server (python/djust/mcp/server.py) running as the same operating-system user; there is no network listener, so remote exploitation is not possible. The attacker must be able to invoke the find_handlers_for_template tool with an absolute template_path, and disclosure is limited to (a) whether the target file exists and is readable by the djust process and (b) substrings matching the dj-click/dj-submit/dj-change/dj-input/dj-keydown/dj-keyup attribute pattern - not arbitrary raw file contents. Key limiting factors: local-only access, the shared-user trust boundary (the attacker already runs with the victim's privileges), and the narrow pattern-matched output rather than full file read. Affects djust from 0.9.0 before 1.0.10, 1.1.x before 1.1.7, 1.2.x before 1.2.4, and 1.3.0.dev before 1.3.0rc8.

This is a low-priority, genuinely low-real-risk issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 3.3 Low) correctly reflects a local, low-privilege information-disclosure flaw with no integrity or availability impact. The maintainer (GitHub Security Advisory GHSA-r57g-mc79-8hj2) explicitly notes the MCP server communicates over local stdio as the same OS user with no network listener, which aligns with AV:L and makes remote exploitation impossible. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit was referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality impact is further constrained: the tool does not return arbitrary raw file contents but only a file-existence/readability oracle plus substrings matching the narrow dj-click/dj-submit/dj-change/dj-input/dj-keydown/dj-keyup attribute pattern, which justifies C:L rather than C:H. Bottom line: a real but minor defect-in-depth fix for a developer tooling component, not an operational emergency. Note: no EPSS value was present in the provided data, so probabilistic exploitation likelihood could not be cross-referenced.

A local actor (or a malicious/compromised MCP client already running as the same OS user as the djust developer) invokes the find_handlers_for_template MCP tool with crafted absolute paths to probe whether arbitrary files on disk exist and are readable by the djust process, and to extract any dj-*-attribute-shaped substrings from them. Because the vector is local (AV:L) and low-complexity (AC:L) but requires an already-connected local MCP session, impact is confined to limited information disclosure. No public proof-of-concept was referenced in the input.