{"vulnerability": "cve-2026-61598", "sightings": [{"uuid": "a350362d-d092-44b0-8b38-6a9ce427763b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61598", "type": "seen", "source": "https://gist.github.com/alon710/17e19a604dba0f2f8107309615c5a1ab", "content": "# CVE-2026-61598: CVE-2026-61598: Remote State Modification via Mass Assignment in djust Framework\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61598\n\n## Summary\nCVE-2026-61598 is a high-severity mass-assignment vulnerability (CWE-915) affecting the Python package djust prior to version 1.0.7. An authenticated client can supply arbitrary parameter names to modify public view attributes on the server via WebSocket events, leading to unauthorized state manipulation, authorization bypass, or price tampering.\n\n## TL;DR\nA mass-assignment vulnerability in djust allows authenticated clients to modify arbitrary public server-side view attributes via crafted WebSocket payloads.\n\n## Technical Details\n\n- **CWE ID**: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)\n- **Attack Vector**: Network\n- **CVSS v4.0**: 7.1\n- **Exploit Status**: None / No Public PoC\n- **CISA KEV Status**: Not Listed\n- **Remediation**: Upgrade to 1.0.7 or declare explicit allowed_model_fields\n\n## Affected Systems\n\n- Applications implementing python package djust versions < 1.0.7 on Django\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or higher to transition to a safe-by-default posture.\n- Manually override allowed_model_fields on Legacy LiveViews when patching is delayed.\n- Keep sensitive data isolated in private properties or session storage.\n\n**Remediation Steps:**\n1. Run your dependency checker or pip list to verify the current djust version.\n2. Upgrade using the command: pip install --upgrade djust>=1.0.7\n3. Identify instances of dynamic template bindings and configure allowed_model_fields manually if required.\n4. Refactor public LiveView attributes containing authorization or transactional variables to prevent state manipulation.\n\n## References\n\n- [GitHub Security Advisory GHSA-cc7c-9jff-58wj](https://github.com/djust-org/djust/security/advisories/GHSA-cc7c-9jff-58wj)\n- [djust Release Notes v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61598 Record](https://www.cve.org/CVERecord?id=CVE-2026-61598)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61598) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T14:31:54.764638Z"}]}