CVE-2026-61597

What it is

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Version 1.0.7 contains a fix. As a workaround, do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account, but needs a user to act. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-16 22:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-30 17:51 UTC Last updatedMost recent change to the record

Details

Published

2026-09-16 22:17 UTC

Last modified

2026-09-30 17:51 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Deferred

Attack profile CVSS 4.0 · 5.1

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

Passive

Confidentiality

None

Integrity

None

Availability

None