CVE-2026-61598

The djust Python LiveView framework ships a default update_model WebSocket event handler (from ModelBindingMixin, part of the LiveView base MRO) that sets a client-supplied attribute name to a client-supplied value, gated only by a rejection of underscore-prefixed names, a 14-entry denylist of framework internals, a hasattr check, and an optional allowed_model_fields allowlist that defaults to None (allow all). Any connected client can send an update_model event over the WebSocket to set any public, existing view attribute — including attributes never bound with dj-model= in the template — with automatic type coercion matching the target attribute, and every LiveView exposes this handler by default. An attacker reaching a LiveView (anonymously on public views, or as a logged-in user on authenticated views) can tamper with view state such as is_admin, account_id, or business values, enabling authorization-flag manipulation, IDOR, and state tampering wherever downstream handlers act on those attributes without re-checking authorization. All djust applications using LiveViews are affected, with high impact for apps that hold authorization, ownership, or business state in public view attributes (the normal djust pattern) and low impact otherwise. No public proof-of-concept or in-the-wild exploitation is known; the flaw was reproduced by the maintainer and a fix approach is documented, but no fixed version number is stated in the disclosure.

What to do: Until a patched release is published (no fixed version number is given in the disclosure), set allowed_model_fields explicitly to the minimal list of bindable fields on every view using dj-model= or subclassing LiveView, and stop storing authorization, ownership, or business state (e.g., is_admin, account_id, total_price) in public view attributes that share the view with dj-model bindings. Audit LiveViews for such state and for downstream handlers that trust view attributes without re-authorization; upgrade to the patched djust release once available and verify that a non-dj-model public attribute such as is_admin is rejected while bound fields still update.