CVE-2026-61591: State Snapshot Injection and Mass Assignment in djust Framework

The djust framework is designed to provide reactive, server-side rendered application state synchronization using Django on the backend and WebSockets or Server-Sent Events (SSE) on the frontend. To optimize user navigation, particularly back-navigation, developers can configure the enable_state_snapshot attribute within their LiveView classes.\n\nWhen a client navigates back to a previously loaded view, instead of executing a standard, backend-controlled initialization path through the mount method, the client returns a serialized representation of its last known state, termed the state snapshot. This state is contained inside the state_json parameter and parsed directly by the server to reconstruct the dynamic attributes of the view interface.\n\nIn versions of the framework prior to 1.0.7, this restoration flow lacked verification mechanisms to confirm the authenticity and integrity of the client-provided state. This structural design vulnerability allows a malicious client to modify local serialized states and transmit forged properties to the server, resulting in state injection (CWE-915) and bypass of critical authorization systems.

The root cause of this vulnerability lies in the lack of cryptographic validation of the state snapshot before the restoration process. During typical operation, the state snapshot is sent from the client browser over a WebSocket handshake during a live_redirect_mount frame. In vulnerable releases of djust, the server-side controller parses the JSON document directly without confirming whether the payload was originally generated and signed by the server.\n\nUpon receiving the state_json payload, the server invokes internal recovery methods, which dynamically assign the properties listed in the JSON dictionary directly onto the instanced view class using an attribute setting function. While the safe_setattr wrapper prevents modification of private and special magic properties, it allows direct, unvetted modification of public variables. Because developers often store authorization variables such as user identification, administrative privilege flags, or transactional balances in these public properties, the state restoration process allows clients to override local business logic.\n\nFurthermore, because the restore workflow skips the default mount function, any verification logic implemented inside the initialization path is bypassed. This dynamic state assignment is executed purely based on client-submitted inputs, enabling attackers to execute privilege escalation or target other client contexts without needing valid credentials.

The vulnerable version of djust deserialized the snapshot without any verification step. Below is the technical comparison of the insecure restoration model versus the patched implementation added in version 1.0.7 inside the file python/djust/security/state_snapshot.py.\n\npython\n# Insecure conceptual state restoration in vulnerable versions (< 1.0.7)\ndef restore_snapshot(view, client_snapshot_dict):\n # NO verification of origin or signature\n for key, value in client_snapshot_dict.items():\n # safe_setattr only prevents underscore-prefixed names\n safe_setattr(view, key, value)\n\n\nThe implementation introduced in version 1.0.7 mitigates this vulnerability by using Django's cryptographic TimestampSigner combined with a designated salt configuration (SNAPSHOT_SALT = "djust.state_snapshot"). Below is the structured representation of the secure snapshot verification module:\n\npython\n# Patched secure snapshot verification implementation in version 1.0.7\nfrom django.core import signing\nimport json\n\nSNAPSHOT_SALT = "djust.state_snapshot"\n\ndef sign_snapshot(state_json: str, view_slug: str, session_key: str) -> str:\n # Bind state to specific view and session to prevent cross-view or cross-session replay\n envelope = json.dumps({\n "slug": view_slug,\n "sid": session_key or "",\n "state": state_json\n }, sort_keys=True)\n return signing.TimestampSigner(salt=SNAPSHOT_SALT).sign(envelope)\n\n\nThe verified snapshot restoration verifies the cryptographic signature, the expiration timestamp (TTL), the matching view slug, and the active session key. If any of these validations fail, the framework throws an error or silently falls back to executing the secure, backend-controlled mount() initialization flow, entirely neutralizing injection attempts.

Exploitation of this vulnerability requires an attacker to interact with a web page utilizing the djust library with state snapshots enabled. The attacker identifies the presence of the snapshot feature by reviewing network transmissions or inspecting local storage structures containing the serialized state attributes.\n\nOnce a target view is identified, the attacker modifies the local plaintext JSON snapshot before a history navigation event is triggered. Alternatively, the attacker intercepts the WebSocket connection and alters the data payload of the live_redirect_mount frame. This manipulation alters the data values to grant administrative properties or target alternative account records.\n\njson\n{\n "type": "live_redirect_mount",\n "view": "myapp.views.MyDashboardView",\n "url": "/dashboard/",\n "state_snapshot": {\n "view_slug": "myapp.views.MyDashboardView",\n "state_json": "{\"is_admin\": true, \"account_id\": 1}",\n "ts": 0\n }\n}\n\n\nWhen the modified frame is transmitted to the server, the lack of signature validation causes the backend to parse the dictionary directly. The dynamic attribute loops apply the values to the active session object, granting immediate administrative permissions or access to private customer accounts.

The impact of this vulnerability is classified as High, with a CVSS v3.1 base score of 8.1. An attacker can exploit this flaw to bypass authentication logic, escalate privileges, and gain access to restricted data fields.\n\nBecause the vulnerability allows direct, unchecked attribute assignment, its exact severity is determined by the specific variables exposed inside the view instance. If an application stores financial transactions, administrative flags, or sensitive personal indicators as public attributes on its views, those values can be altered.\n\nCurrently, there is no evidence of active exploitation in the wild, and the vulnerability is not listed on the CISA KEV catalog. However, because the exploit process requires minimal sophistication, immediate application of the patch or configuration workarounds is required to protect deployment environments.

The primary mitigation for this vulnerability is to upgrade the djust package to version 1.0.7 or higher, which includes the cryptographic signature framework. This signature blocks unauthorized snapshot modifications by verifying authenticity on each reconnection handshake.\n\nbash\npip install --upgrade djust>=1.0.7\n\n\nIf upgrading is not feasible, organizations must disable the state snapshot feature globally by ensuring enable_state_snapshot = False is set across all application view classes. This forces the framework to initialize views through the secure server-side mount() method on every navigation event.\n\nIn addition, developers must follow secure coding practices by avoiding storing authorization flags or critical backend identifiers in public view attributes. Standardizing authorization validation using session-based variables guarantees security boundaries are enforced.