Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-113731djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Low 3.3

In plain English

A low-severity path traversal in djust from djust-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 91.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py accepts an existing absolute template_path and reads it without restricting the resolved path to the project or configured template directories. A local MCP client can use the tool as a file existence and readability oracle and can obtain substrings that match the tool's dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern from files readable by the djust process. The maintainer assessment states that the MCP server communicates over local stdio as the same operating-system user and has no network listener, and the tool does not return arbitrary raw file contents. This issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIdjust1.0.10GHSA-r57g-mc79-8hj2
PyPIdjust1.1.7GHSA-r57g-mc79-8hj2
PyPIdjust1.2.4GHSA-r57g-mc79-8hj2
PyPIdjust1.3.0rc8GHSA-r57g-mc79-8hj2

Affected products (as reported)

VendorProductVersions
djust-org djust >= 0.9.0, < 1.0.10>= 1.1.0, < 1.1.7>= 1.2.0.dev0, < 1.2.4>= 1.3.0.dev0, < 1.3.0rc8

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References