HIGH GitHub
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
### Impact
The djust live transport resolves the LiveView to mount from a **client-supplied dotted path** by calling `__import__(module_path, ...)`. The module is imported — running its **top-level code (import side effects)** — *before* the framework checks that the resolved object is a `LiveView` subclass and *before* any per-view authentication. The `LIVEVIEW_ALLOWED_MODULES` allowlist that should contain this is **fail-open** (`if allowed_modules:` — skipped when the setting is unset, the fr
Affected Products
- pip/djust < 1.0.7
References
- https://github.com/advisories/GHSA-7prp-2623-8g45
- https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45
- https://github.com/djust-org/djust/releases/tag/v1.0.7
- https://github.com/advisories/GHSA-7prp-2623-8g45
This high severity vulnerability was published on 2026-09-16 via GitHub. Affected: pip/djust < 1.0.7.
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.