THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-7prp-2623-8g45 (high) — djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

[GHSA] GHSA-7prp-2623-8g45 (high) — djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

medgithub_advisoriesPublished 2026-09-16

GHSA-7prp-2623-8g45 Severity: high CVE: CVE-2026-61599

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

### Impact The djust live transport resolves the LiveView to mount from a **client-supplied dotted path** by calling `__import__(module_path, ...)`. The module is imported — running its **top-level code (import side effects)** — *before* the framework

Indicators of compromise

CVE-2026-61599cve

Original source: https://github.com/advisories/GHSA-7prp-2623-8g45