EUVD-2026-80744
GHSA-8g2f-g3gq-5rjv
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated (PR:N) but gated by the DEBUG-on-plus-missing-middleware misconfiguration (AC:H); state disclosure gives C:H and eval_handler invocation gives I:H, with no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (eval_handler). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and eval_handler is restricted; gated requests receive a non-disclosing response. As a workaround, ensure DEBUG=False in production, and do not expose the observability endpoints to untrusted networks.
AnalysisAI
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the specific documented-but-misconfigured state: Django DEBUG=True in production AND the opt-in localhost-restriction middleware not installed, leaving djust's observability endpoints (live view/session state plus the eval_handler method-invocation surface) reachable from a non-localhost network client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4) is well-calibrated: network-reachable and unauthenticated (PR:N), but gated by AC:H because exploitation requires a specific misconfiguration - DEBUG left on in production AND the opt-in localhost middleware not installed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading djust to 1.0.7 or later (pip install --upgrade djust), per the advisory at https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv and the release at https://github.com/djust-org/djust/releases/tag/v1.0.7; this version enforces the localhost restriction in-view on every observability endpoint instead of depending on a separately installed middleware, restricts `eval_handler`, and returns a non-disclosing response for gated requests, so no additional configuration is needed for the core fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment running djust, determine whether DEBUG is enabled in any environment, and where it is, set DEBUG=False and restart the affected services; in parallel, block network access to the observability endpoints at the reverse proxy or firewall so only localhost or trusted management hosts can reach them. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today