{"id":"CVE-2026-61599","kind":"vulnerability","aliases":["CVE-2026-61599","GHSA-7prp-2623-8g45"],"related":[],"title":"djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path","description":"### Impact\nThe djust live transport resolves the LiveView to mount from a **client-supplied dotted path** by calling `__import__(module_path, ...)`. The module is imported — running its **top-level code (import side effects)** — *before* the framework checks that the resolved object is a `LiveView` subclass and *before* any per-view authentication. The `LIVEVIEW_ALLOWED_MODULES` allowlist that should contain this is **fail-open** (`if allowed_modules:` — skipped when the setting is unset, the framework default) and uses loose `startswith` matching.\n\nAn **unauthenticated** WebSocket client (the WS handshake does not require auth; per-view auth runs only after import + instantiate) can therefore send a `mount` / `live_redirect_mount` / `url_change` frame (or an SSE mount) with `view = \"<any.importable.module>.AnyName\"` and cause the server to import — and execute the top-level code of — **any importable Python module by name**.\n\n**Consequences:** server-side execution of arbitrary importable modules' import-time side effects by an unauthenticated client (effectively RCE-by-proxy on any host that has a side-effectful importable module), denial of service (import bombs / expensive dependency trees), and a module/class **enumeration oracle** via distinct error strings.\n\nReproduced end-to-end: an unauthenticated `WebsocketCommunicator` `mount` frame with the allowlist unset imported and executed a sentinel non-LiveView module before the \"not a LiveView subclass\" rejection.\n\n### Affected code\n- `python/djust/websocket.py` `handle_mount` (`__import__` of the client `view`)\n- `python/djust/runtime.py` `ViewRuntime.dispatch_mount` / `_instantiate_view` (SSE + `url_change` path)\n- `python/djust/sse.py` SSE mount\n\nThreat-model entry T4 (`docs/audits/websocket-auth-2026-06.md`) previously noted the default-open allowlist but understated the impact as mere LiveView-class probing; the real primitive is arbitrary-module import + top-level code execution, independent of whether the target is a LiveView.\n\n### Patches\nFixed by a fail-**closed** resolution gate (`djust._view_resolution.is_view_import_allowed`): a client view path resolves only if (a) its module is **already loaded** (`sys.modules` — so resolving runs no new code; URL-routed views loaded by URLconf at startup keep working with zero config) or (b) it matches `LIVEVIEW_ALLOWED_MODULES` on a **module-segment boundary** (explicit opt-in for lazily-imported views). The gate runs **before** `__import__` at all three sinks (+ defense-in-depth inside `_instantiate_view`).\n\n### Workarounds\nSet `LIVEVIEW_ALLOWED_MODULES` to the narrow list of modules that contain your mountable LiveView classes. (Note: pre-patch the allowlist is `startswith`-matched and the import still precedes the subclass check, so this is mitigation, not a complete fix.)\n\n### References\nReproducer + finding writeup retained privately by the maintainer.","summary":"djust resolves a client-supplied dotted view path with __import__ before checking authentication or that the object is a LiveView, so the module's top-level code runs. An unauthenticated client can therefore execute import-time code of any importable Python module, and can also use error messages to enumerate modules.","severity":"high","cvss":8.8,"epss":0.00604,"exploited":false,"exploited_at":null,"products":[{"name":"djust","fixed":["1.0.7"],"affected":"< 1.0.7","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-470","django","djust","package","python","sse","websocket"],"not_affected_if":["djust-not-installed","live-transport-not-exposed","version-1.0.7-or-later"],"how_to_check":"- Check the installed djust version with `pip show djust` and compare it to the fixed range.\n- Check the Django settings for `LIVEVIEW_ALLOWED_MODULES`; if it is unset, the allowlist is fail-open.\n- Look for WebSocket or SSE routes that serve djust LiveViews in publicly reachable deployments.","fix":"- djust: upgrade to `1.0.7` or later (affected versions are below `1.0.7`).\n- Workaround until upgraded: set `LIVEVIEW_ALLOWED_MODULES` to the narrow list of modules that contain your mountable LiveView classes; the sources say this is mitigation, not a complete fix.","status":"open","published_at":"2026-09-16T22:09:38+00:00","first_seen_at":"2026-11-05T23:02:16+00:00","triaged_at":"2026-11-05T23:03:12+00:00","updated_at":"2026-11-05T23:15:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T23:03:12Z","model":"claude-haiku-5-5","output":{"fix":"- djust: upgrade to `1.0.7` or later (affected versions are below `1.0.7`).\n- Workaround until upgraded: set `LIVEVIEW_ALLOWED_MODULES` to the narrow list of modules that contain your mountable LiveView classes; the sources say this is mitigation, not a complete fix.","reach":"internet","title":"djust: unauthenticated WebSocket clients can import and run any Python module","impact":"high","summary":"djust resolves a client-supplied dotted view path with __import__ before checking authentication or that the object is a LiveView, so the module's top-level code runs. An unauthenticated client can therefore execute import-time code of any importable Python module, and can also use error messages to enumerate modules.","audience":"developers","category":"package","nicknames":[],"who_cares":["django","djust","python","websocket","sse"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated client runs import-time code of any importable Python module","analyst_note":"Confirm from the GHSA page whether the default unset LIVEVIEW_ALLOWED_MODULES actually reaches the vulnerable path in all configurations, and whether the fail-closed gate changes behaviour for URL-routed views.","how_to_check":"- Check the installed djust version with `pip show djust` and compare it to the fixed range.\n- Check the Django settings for `LIVEVIEW_ALLOWED_MODULES`; if it is unset, the allowlist is fail-open.\n- Look for WebSocket or SSE routes that serve djust LiveViews in publicly reachable deployments.","plain_action":"","needs_analyst":true,"not_affected_if":["djust-not-installed","version-1.0.7-or-later","live-transport-not-exposed"],"who_is_affected":"Any Django application that runs djust with its live WebSocket or SSE transport exposed to clients is exposed, because the mount path does not require authentication before importing the requested module. Applications that do not use djust, or that keep the live transport unreachable from untrusted networks, can skip it; the sources do not say whether the flaw needs any specific view configuration beyond the default unset allowlist.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000921,"input_tokens":5287,"output_tokens":785,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,25A '-470':29B '-61599':17A,26A '-8':22A '2623':21A '7prp':20A 'affect':313C 'allow':146C,158C,427C,463C 'allowlist':148C,295C,347C,482C 'alreadi':399C 'also':83B 'anynam':211C 'arbitrari':5A,238C,363C 'arbitrary-modul':362C 'auth':184C,188C 'authent':49B,143C 'b':423C 'bomb':270C 'boundari':434C 'call':108C 'caus':213C 'chang':203C,330C 'check':48B,128C,493C 'class':356C,476C 'client':40B,68B,103C,177C,249C,321C,389C 'client-suppli':39B,102C 'close':384C 'code':64B,75B,121C,224C,314C,369C,407C 'complet':500C 'config':421C 'consequ':232C 'contain':151C,472C 'cve':15A,24A 'cwe':28B 'default':168C,345C 'default-open':344C 'defens':454C 'defense-in-depth':453C 'denial':266C 'depend':272C 'depth':456C 'distinct':280C 'django':30B 'djust':1A,27A,31B,36B,92C 'djust._view_resolution.is_view_import_allowed':387C 'docs/audits/websocket-auth-2026-06.md':340C 'dot':42B,105C 'effect':124C,245C,250C,263C 'end':285C,287C 'end-to-end':284C 'entri':338C 'enumer':88B,277C 'error':85B,281C 'execut':71B,219C,236C,299C,370C 'expens':271C 'explicit':435C 'fail':155C,383C 'fail-open':154C 'find':504C 'fix':380C,501C 'frame':204C,292C 'framework':127C,167C 'g45':23A 'gate':386C,445C 'ghsa':19A 'ghsa-7prp':18A 'handl':316C 'handshak':180C 'host':257C 'impact':90C,351C 'import':7A,46B,73B,78B,109C,115C,122C,192C,217C,227C,239C,242C,264C,269C,297C,318C,365C,442C,448C,488C 'import-tim':72B,241C 'independ':371C 'insid':457C 'instanti':193C,326C,458C 'keep':417C 'lazili':441C 'lazily-import':440C 'level':63B,120C,223C,368C 'list':468C 'live':93C,199C 'liveview':56B,97C,135C,145C,304C,310C,355C,378C,426C,462C,475C 'liveview-class':354C 'load':400C,412C 'loos':171C 'maintain':510C 'match':173C,425C,485C 'mere':353C 'messag':86B 'mitig':497C 'model':337C 'modul':6A,59B,80B,89B,110C,113C,147C,159C,229C,240C,265C,305C,364C,397C,428C,432C,464C,470C 'module-seg':431C 'module/class':276C 'mount':13A,99C,198C,201C,208C,291C,317C,325C,334C 'mountabl':474C 'name':231C 'narrow':467C 'new':406C 'non':303C 'non-liveview':302C 'note':342C,477C 'object':53B,132C 'open':156C,346C 'opt':437C 'opt-in':436C 'oracl':278C 'packag':32B 'patch':379C,480C 'path':14A,44B,106C,111C,331C,391C 'per':141C,186C 'per-view':140C,185C 'pre':479C 'pre-patch':478C 'preced':490C 'previous':341C 'primit':360C 'privat':507C 'probe':357C 'proxi':254C 'python':33B,79B,228C 'python/djust/runtime.py':323C 'python/djust/sse.py':332C 'python/djust/websocket.py':315C 'rce':252C 'rce-by-proxi':251C 'real':359C 'redirect':200C 'refer':502C 'reject':312C 'reproduc':283C,503C 'requir':183C 'resolut':385C 'resolv':37B,95C,131C,392C,403C 'retain':506C 'rout':410C 'run':65B,116C,189C,404C,446C 'segment':433C 'send':196C 'sentinel':301C 'server':215C,234C 'server-sid':233C 'servic':268C 'set':163C,461C 'side':123C,235C,244C,262C 'side-effect':261C 'sink':452C 'skip':160C 'sse':34B,207C,328C,333C 'startswith':172C,484C 'startup':416C 'still':489C 'string':282C 'subclass':136C,311C,492C 'suppli':41B,104C 'sys.modules':401C 't4':339C 'target':375C 'therefor':70B,195C 'threat':336C 'threat-model':335C 'three':451C 'time':74B,243C 'top':62B,119C,222C,367C 'top-level':61B,118C,221C,366C 'transport':94C 'tree':273C 'unauthent':4A,67B,175C,248C,289C 'underst':349C 'unset':165C,296C 'url':202C,329C,409C 'url-rout':408C 'urlconf':414C 'use':84B,170C 'via':8A,279C 'view':12A,43B,142C,187C,210C,322C,327C,390C,411C,443C,459C 'view-mount':11A 'viewruntime.dispatch':324C 'websocket':35B,176C 'websocket/sse':10A 'websocketcommun':290C 'whether':373C 'work':418C 'workaround':460C 'writeup':505C 'ws':179C 'zero':420C","nicknames":[],"mitigations":[],"who_affected":"Any Django application that runs djust with its live WebSocket or SSE transport exposed to clients is exposed, because the mount path does not require authentication before importing the requested module. Applications that do not use djust, or that keep the live transport unreachable from untrusted networks, can skip it; the sources do not say whether the flaw needs any specific view configuration beyond the default unset allowlist.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["djust"],"ptokens":["djust"],"labels":["cwe470","django","djust","high","package","pypi","python","sse","websocket"],"campaign_type":null,"first_public_at":"2026-06-22T17:09:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7prp-2623-8g45","url":"https://github.com/advisories/GHSA-7prp-2623-8g45","severity":"high","published_at":"2026-09-16T22:09:38+00:00","modified_at":"2026-11-05T23:01:11+00:00","first_seen_at":"2026-11-05T23:02:16+00:00","fetched_at":"2026-11-05T23:17:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-61599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61599","severity":null,"published_at":"2026-09-16T23:16:54+00:00","modified_at":"2026-09-30T17:51:56+00:00","first_seen_at":"2026-11-05T23:15:56+00:00","fetched_at":"2026-11-05T23:15:56+00:00","note":null}],"documents":[{"id":81240,"url":"https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-7prp-2623-8g45","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":81241,"url":"https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-22T17:09:44+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":81242,"url":"https://github.com/djust-org/djust/releases/tag/v1.0.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":81243,"url":"https://github.com/djust-org/djust/commit/04985e2f6a69faf265fc512b323d28adaa15c3ff","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00604,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61599"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}