pypi

djust

16 Total advisories

16 Vulnerabilities

0 Malware

Dependency scanning

Check whether djust is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

djust

Vulnerabilities

djust: A template binding inherits a context safety grant it never earned (XSS)

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust has an authorization bypass on the WebSocket/SSE mount path

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust has broken object-level access control (IDOR)

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Browse more PyPI advisories

Start Securing