CVE-2026-61588: djust Package Exposes Sensitive Fields in Public Views
Summary
CVE-2026-61588: Impact When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password (the hash), privilege flags (e.g. Affects djust versions < 1.0.7. Fixed in 1.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
djust is a Python package designed for Django applications, facilitating model serialization and data handling. It allows developers to easily expose model instances to templates and public views. However, this convenience comes with a risk, as the package lacks a sensitive-field denylist, potentially leading to the exposure of sensitive information.
Vulnerability Detail
The vulnerability arises from djust's serialization process, which does not filter out sensitive fields when a Django Model instance is assigned to a public view attribute. This oversight can lead to the unintentional transmission of sensitive information, such as password hashes, privilege flags (like is_staff or is_superuser), and personally identifiable information (PII) to the client. The ramifications include potential data breaches and unauthorized access to sensitive user data, as developers may not realize that sensitive information is being sent over the network.
How To Fix
Latest published version: 1.2.6 as of 22 Oct 2026
pip install --upgrade "djust==1.2.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.7
This is the first release that contains the fix.
pip install --upgrade "djust==1.0.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, keep Model instances on private attributes and expose only the specific fields needed for public views. For example, instead of directly exposing the entire model, you can create a dictionary of only the required fields:
public_data = {
'name': model_instance.name,
'email': model_instance.email,
}
Conclusion
The djust package has a vulnerability that exposes sensitive fields in public views, which can lead to serious security risks. It is crucial to update to the patched version 1.0.7 to mitigate these risks. Until then, developers should implement workarounds to protect sensitive information.
See every vulnerability recorded for djust →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The types of sensitive information at risk include password hashes, privilege flags, tokens, and personally identifiable information (PII).
Yes, a patch is available in djust version 1.0.7, which implements a sensitive-field denylist.
If you cannot update the package immediately, implement the suggested workaround by keeping Model instances on private attributes and exposing only the necessary fields.
References
Related vulnerabilities
Recent vulnerabilities recorded for djust.
