要点
- CVE-2026-61592 は djust に影響する深刻度「高」 (CVSS 7.4) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.39%（全脆弱性の 32.9% より高い）。
- 対処：1.0.7 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| djust PyPI | < 1.0.7
| 1.0.7
|
概要
Impact
SSE sessions were keyed solely by a client-chosen session_id with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a session_id could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state.
Patches
Fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal.
Workarounds
Disable the SSE transport short of upgrading.
NVD の説明
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen `session_id` with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a `session_id` could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. This is fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal. As a workaround, disable the SSE transport.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン