CVE-2026-61590

Observability endpoints in the djust pip package (a Django live-view framework) expose live view/session state and a remote method-invocation surface (`eval_handler`) over the network. The localhost-only restriction was implemented as an opt-in middleware that the documented setup omits, while the endpoint views themselves enforced only the DEBUG flag, so in the documented configuration with DEBUG=True a non-localhost client could reach these endpoints without authentication. An attacker gains disclosure of live application and session state (CWE-668) plus the ability to remotely invoke handlers (CWE-306), yielding both confidentiality and integrity impact. Anyone running djust versions prior to 1.0.7 without the optional middleware and with the observability endpoints reachable from an untrusted network is affected. No public proof-of-concept is known and the flaw is not listed in CISA KEV.

What to do: Upgrade to djust 1.0.7 or later, which enforces the localhost restriction in-view on every observability endpoint and restricts `eval_handler`. Ensure DEBUG=False in production and do not expose the observability endpoints to untrusted networks; check access logs for external requests to these endpoints on pre-1.0.7 deployments.