CVE-2026-113731: djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without restricting the resolved path to the project or configured template directories. A local MCP client can use the tool as a file existence and readability oracle and can obtain substrings that match the tool's dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern from files readable by the djust process. The maintainer assessment states that the MCP server communicates over local stdio as the same operating-system user and has no network listener, and the tool does not return arbitrary raw file contents. This issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.10
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
A local MCP client running as the same operating-system user as the djust MCP server can exploit it. The server communicates over local stdio and has no network listener, so remote network-only attackers are not described as an exposure path.
What information can an attacker obtain?
The tool can reveal whether an absolute path exists and is readable by the djust process. It can also return substrings matching dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute patterns, rather than arbitrary raw file contents.
Which releases contain fixes?
The issue is fixed in djust versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8. Affected versions begin at 0.9.0 and extend until the applicable fixed release.