MEDIUM 6.5 GitHub
CVE-2026-61588
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
### Impact
When a Django `Model` instance is assigned to a **public** view attribute, djust serialized it to the client with **no sensitive-field denylist** — sending fields such as `password` (the hash), privilege flags (e.g. `is_staff` / `is_superuser`), tokens, and other PII to the browser. Because exposing model objects to templates is a normal djust pattern, this could leak credentials/PII without the developer realizing the full object crossed the wire.
### Patches
Fixed in **djust 1.0.7*
Affected Products
- pip/djust < 1.0.7
References
- https://github.com/advisories/GHSA-pvg3-6q9j-mj3x
- https://github.com/djust-org/djust/security/advisories/GHSA-pvg3-6q9j-mj3x
- https://github.com/djust-org/djust/releases/tag/v1.0.7
- https://github.com/advisories/GHSA-pvg3-6q9j-mj3x
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-16 via GitHub. Affected: pip/djust < 1.0.7.
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.