CVE-2026-31815: django-unicorn Component State Manipulation via Unvalidated Attribute Access
Summary
CVE-2026-31815: django-unicorn affected by component state manipulation via unvalidated attribute access. Affects django-unicorn versions < 0.67.0. Fixed in 0.67.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-unicorn is a Python package designed for building interactive web applications using Django. It allows developers to create dynamic components that can communicate with the server without requiring full page reloads. The package provides a framework for managing component states and rendering templates efficiently. However, it is vulnerable to unauthorized manipulation of component states due to insufficient access control checks.
Vulnerability Detail
The vulnerability in django-unicorn arises from the lack of access control during property updates and method calls. Specifically, the framework does not properly enforce visibility boundaries defined by the '_is_public' attribute. This oversight allows attackers to bypass intended protections and modify internal attributes, such as 'template_name', or invoke protected methods. The vulnerability is located in the action parsers, particularly in the 'set_property_value()' and '_call_method_name()' functions, which utilize 'getattr' and 'setattr' without verifying if the target attribute is public. As a result, unauthorized users can render sensitive templates or reset component states, leading to potential exposure of sensitive information.
How To Fix
Minimum fixed version
0.67.0
This is the first release that contains the fix.
pip install --upgrade "django-unicorn==0.67.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional access control checks in your application to validate attribute access before allowing updates. This can be done by overriding the methods responsible for setting properties and calling methods to include checks against the '_is_public' attribute.
Conclusion
In summary, CVE-2026-31815 represents a significant vulnerability in the django-unicorn package that allows unauthorized manipulation of component states. It is crucial for developers using this package to update to the latest version to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for django-unicorn →
FAQ
CVE-2026-31815 is a vulnerability in the django-unicorn package that allows unauthorized manipulation of component states due to insufficient access control.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without needing to sign up.
The risks include unauthorized access to sensitive templates and the ability to manipulate component states, which could lead to information exposure.
Yes, a patch is available in version 0.67.0 of django-unicorn. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for django-unicorn.
