Résumé
djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
Détails de l’avis
Impact
For views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).
Patches
Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.
Workarounds
Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- HIGHCVE-2026-62367
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
- CRITICALCVE-2026-105863
Payload authentication token field handling issue
- HIGHCVE-2026-106100
Payload: Field-level write access bypass in Payload on MongoDB
- HIGHCVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
- HIGHCVE-2026-61428
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing