{"metadata": {"vulnerability": "CVE-2026-61599", "count": 16, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-10T17:12:17.238Z", "date_only": false, "value": "2026-07-10T17:12:17.238Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61599", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-16T22:09:38Z", "date_only": false, "value": "2026-09-16T22:09:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7PRP-2623-8G45", "record": "GHSA-7PRP-2623-8G45", "field": "published"}, {"timestamp": "2026-09-16T22:09:38Z", "date_only": false, "value": "2026-09-16T22:09:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7PRP-2623-8G45", "record": "GHSA-7PRP-2623-8G45", "field": "modified"}, {"timestamp": "2026-09-16T22:11:45.780Z", "date_only": false, "value": "2026-09-16T22:11:45.780Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61599", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-16T22:11:45.780Z", "date_only": false, "value": "2026-09-16T22:11:45.780Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61599", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T23:16:54.010Z", "date_only": false, "value": "2026-09-16T23:16:54.010", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61599", "record": "FKIE_CVE-2026-61599", "field": "published"}, {"timestamp": "2026-09-16T23:56:41.776Z", "date_only": false, "value": "2026-09-16T23:56:41.776060Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hft3iyt3pw32m", "record": "CVE-2026-61599", "field": "creation_timestamp", "uuid": "979e7a8d-341e-4514-a50a-320a7ed074cd", "content": "CVE-2026-61599 - djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path\nCVE ID : CVE-2026-61599\n \n Published : Sept. 16, 2026, 11:16 p.m. | 19\u00a0minutes ago\n \n Description : djust provides Phoenix LiveView-style reactive server-side rendering ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/hft3iyt3pw32m"}, {"timestamp": "2026-09-17T04:02:11.530Z", "date_only": false, "value": "2026-09-17T04:02:11.530184Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/3bd86382db78b41a2e654bff6d0c8d75", "record": "CVE-2026-61599", "field": "creation_timestamp", "uuid": "e4c79eb5-9eeb-4781-9c55-db3aa391780c", "content": "**CVE-2026-61599** is a high-severity (8.8) vulnerability in `djust`, a Django package for reactive server-side rendering. Versions prior to 1.0.7 allow **unauthenticated remote code execution** via WebSocket/SSE frames. The flaw occurs because client-supplied module paths are imported before authentication, using a fail-open allowlist with loose `startswith` matching. This enables attackers to execute arbitrary Python code from any importable module. \n\n**Fix & Mitigation:** Patched in **v1.0.7** with a strict fail-closed import gate. Until then, restrict `LIVEVIEW_ALLOWED_MODULES` to a narrow explicit list, though pre-patch configurations remain partially exposed.", "url": "https://gist.github.com/ichintu/3bd86382db78b41a2e654bff6d0c8d75"}, {"timestamp": "2026-09-17T07:32:46.942Z", "date_only": false, "value": "2026-09-17T07:32:46.942003Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/1597536733cc04eb6b518d3f17d63c1c", "record": "CVE-2026-61599", "field": "creation_timestamp", "uuid": "d40905c9-57df-4703-9dc9-2afdd3524aea", "content": "# CVE-2026-61599: CVE-2026-61599: Unauthenticated Arbitrary Module Import in djust Framework\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61599\n\n## Summary\nA critical unauthenticated arbitrary module import vulnerability in the djust framework before version 1.0.7 allows remote attackers to execute arbitrary code by exploiting unsafe Python reflection during LiveView connection mounting.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary code on djust-enabled Django applications via crafted WebSocket payloads exploiting unsafe dynamic Python imports.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-470\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.8 (High)\n- **EPSS Score**: Not Assigned\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or later to implement strict, fail-closed view resolution validation.\n- Manually define the LIVEVIEW_ALLOWED_MODULES configuration setting with precise allowed modules to restrict the attack surface.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade djust' or update your project's requirements file to specify djust>=1.0.7.\n2. Verify the installation of djust version 1.0.7 using 'pip show djust'.\n3. In your Django settings.py file, define LIVEVIEW_ALLOWED_MODULES as a list of exact module paths containing authorized views.\n4. Restart all running Django application server instances to apply the configuration updates.\n\n## References\n\n- [GitHub Security Advisory GHSA-7prp-2623-8g45](https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61599 Record](https://www.cve.org/CVERecord?id=CVE-2026-61599)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61599) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/1597536733cc04eb6b518d3f17d63c1c"}, {"timestamp": "2026-09-17T13:21:13.251Z", "date_only": false, "value": "2026-09-17T13:21:13.251135Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61599", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-17T13:21:13.251Z", "date_only": false, "value": "2026-09-17T13:21:13.251135Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61599", "record": "FKIE_CVE-2026-61599", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-17T13:21:22.309Z", "date_only": false, "value": "2026-09-17T13:21:22.309Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61599", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-17T13:21:22.309Z", "date_only": false, "value": "2026-09-17T13:21:22.309Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61599", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-30T17:51:56.193Z", "date_only": false, "value": "2026-09-30T17:51:56.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61599", "record": "FKIE_CVE-2026-61599", "field": "lastModified"}, {"timestamp": "2026-10-01T16:38:32.198Z", "date_only": false, "value": "2026-10-01T16:38:32.198167Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4038", "record": "PYSEC-2026-4038", "field": "published"}, {"timestamp": "2026-10-01T17:10:21.313Z", "date_only": false, "value": "2026-10-01T17:10:21.313040Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4038", "record": "PYSEC-2026-4038", "field": "modified"}]}