CVE-2026-61591: djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
Impact For views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip isadmin to True, or change accountid / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).
Patches Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.
Workarounds Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.
Other sources
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip isadmin to True, or change accountid / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.
djust views (state snapshots) state snapshots = disabled - Compensating control
Ensure authorization/ownership state (e.g., admin flags and account/balance fields) is not stored in public view attributes that a client can modify.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using djust views that have opted into state snapshots are exposed. The risk is greatest where public view attributes hold authorization, ownership, account, balance, or other business-sensitive state.
What does an attacker need to exploit it?
An attacker needs to be able to modify the unsigned state_json embedded in their client page and send it back in a reconnect mount frame. No user interaction is required, but the attack requires low privileges.
Are default configurations affected?
The issue applies only to views that enable state snapshots. Views that do not opt into state snapshots are not described as affected by this vulnerability.
What can be done if upgrading is not immediately possible?
Disable state snapshots and avoid storing authorization or ownership decisions in public view attributes. Do not treat client-restored public view state as trustworthy.
How can I determine whether the fix is present?
The issue is fixed in djust 1.0.7, where snapshots are signed and unsigned or forged snapshots are rejected on the back-navigation restore path.