THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-cc7c-9jff-58wj (high) — djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

[GHSA] GHSA-cc7c-9jff-58wj (high) — djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

medgithub_advisoriesPublished 2026-09-16

GHSA-cc7c-9jff-58wj Severity: high CVE: CVE-2026-61598

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

### Impact `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of the **LiveView base MRO**, so every LiveView exposes it. It `setattr`s a view attribute whose **name is client-suppli

Indicators of compromise

Original source: https://github.com/advisories/GHSA-cc7c-9jff-58wj