djust Package Data Disclosure Vulnerability: What We Know

Severity

HIGH

Affected component

djust (pypi)

Affected versions

< 1.0.7 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.3.2, <= 0.3.2 or >= 0.3.4, <= 0.3.4 or >= 0.3.5, <= 0.3.5 or >= 0.3.6, <= 0.3.6 or >= 0.3.7, <= 0.3.7 or >= 0.3.8, <= 0.3.8 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.4, <= 0.9.4 or >= 0.9.5, <= 0.9.5 or >= 0.9.6, <= 0.9.6 or >= 0.9.7, <= 0.9.7 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc10, <= 1.0.0rc10 or >= 1.0.0rc11, <= 1.0.0rc11 or >= 1.0.0rc12, <= 1.0.0rc12 or >= 1.0.0rc13, <= 1.0.0rc13 or >= 1.0.0rc14, <= 1.0.0rc14 or >= 1.0.0rc15, <= 1.0.0rc15 or >= 1.0.0rc16, <= 1.0.0rc16 or >= 1.0.0rc17, <= 1.0.0rc17 or >= 1.0.0rc18, <= 1.0.0rc18 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.0rc4, <= 1.0.0rc4 or >= 1.0.0rc6, <= 1.0.0rc6 or >= 1.0.0rc7, <= 1.0.0rc7 or >= 1.0.0rc8, <= 1.0.0rc8 or >= 1.0.0rc9, <= 1.0.0rc9 or >= 1.0.1, <= 1.0.1 or >= 1.0.1rc1, <= 1.0.1rc1 or >= 1.0.2, <= 1.0.2 or >= 1.0.2rc1, <= 1.0.2rc1 or >= 1.0.2rc2, <= 1.0.2rc2 or >= 1.0.2rc3, <= 1.0.2rc3 or >= 1.0.3, <= 1.0.3 or >= 1.0.3rc1, <= 1.0.3rc1 or >= 1.0.3rc2, <= 1.0.3rc2 or >= 1.0.4, <= 1.0.4 or >= 1.0.4rc1, <= 1.0.4rc1 or >= 1.0.5, <= 1.0.5 or >= 1.0.5rc1, <= 1.0.5rc1 or >= 1.0.5rc2, <= 1.0.5rc2 or >= 1.0.5rc3, <= 1.0.5rc3 or >= 1.0.5rc4, <= 1.0.5rc4 or >= 1.0.5rc5, <= 1.0.5rc5 or >= 1.0.6, <= 1.0.6 or >= 1.0.6rc1, <= 1.0.6rc1 or >= 1.0.6rc2, <= 1.0.6rc2 or >= 1.0.6rc3, <= 1.0.6rc3 or >= 1.0.7rc1, <= 1.0.7rc1 or < 1.0.7 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.3.2, <= 0.3.2 or >= 0.3.4, <= 0.3.4 or >= 0.3.5, <= 0.3.5 or >= 0.3.6, <= 0.3.6 or >= 0.3.7, <= 0.3.7 or >= 0.3.8, <= 0.3.8 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.4, <= 0.9.4 or >= 0.9.5, <= 0.9.5 or >= 0.9.6, <= 0.9.6 or >= 0.9.7, <= 0.9.7 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc10, <= 1.0.0rc10 or >= 1.0.0rc11, <= 1.0.0rc11 or >= 1.0.0rc12, <= 1.0.0rc12 or >= 1.0.0rc13, <= 1.0.0rc13 or >= 1.0.0rc14, <= 1.0.0rc14 or >= 1.0.0rc15, <= 1.0.0rc15 or >= 1.0.0rc16, <= 1.0.0rc16 or >= 1.0.0rc17, <= 1.0.0rc17 or >= 1.0.0rc18, <= 1.0.0rc18 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.0rc4, <= 1.0.0rc4 or >= 1.0.0rc6, <= 1.0.0rc6 or >= 1.0.0rc7, <= 1.0.0rc7 or >= 1.0.0rc8, <= 1.0.0rc8 or >= 1.0.0rc9, <= 1.0.0rc9 or >= 1.0.1, <= 1.0.1 or >= 1.0.1rc1, <= 1.0.1rc1 or >= 1.0.2, <= 1.0.2 or >= 1.0.2rc1, <= 1.0.2rc1 or >= 1.0.2rc2, <= 1.0.2rc2 or >= 1.0.2rc3, <= 1.0.2rc3 or >= 1.0.3, <= 1.0.3 or >= 1.0.3rc1, <= 1.0.3rc1 or >= 1.0.3rc2, <= 1.0.3rc2 or >= 1.0.4, <= 1.0.4 or >= 1.0.4rc1, <= 1.0.4rc1 or >= 1.0.5, <= 1.0.5 or >= 1.0.5rc1, <= 1.0.5rc1 or >= 1.0.5rc2, <= 1.0.5rc2 or >= 1.0.5rc3, <= 1.0.5rc3 or >= 1.0.5rc4, <= 1.0.5rc4 or >= 1.0.5rc5, <= 1.0.5rc5 or >= 1.0.6, <= 1.0.6 or >= 1.0.6rc1, <= 1.0.6rc1 or >= 1.0.6rc2, <= 1.0.6rc2 or >= 1.0.6rc3, <= 1.0.6rc3 or >= 1.0.7rc1, <= 1.0.7rc1 or < 1.0.7 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.3.2, <= 0.3.2 or >= 0.3.4, <= 0.3.4 or >= 0.3.5, <= 0.3.5 or >= 0.3.6, <= 0.3.6 or >= 0.3.7, <= 0.3.7 or >= 0.3.8, <= 0.3.8 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.4, <= 0.9.4 or >= 0.9.5, <= 0.9.5 or >= 0.9.6, <= 0.9.6 or >= 0.9.7, <= 0.9.7 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc10, <= 1.0.0rc10 or >= 1.0.0rc11, <= 1.0.0rc11 or >= 1.0.0rc12, <= 1.0.0rc12 or >= 1.0.0rc13, <= 1.0.0rc13 or >= 1.0.0rc14, <= 1.0.0rc14 or >= 1.0.0rc15, <= 1.0.0rc15 or >= 1.0.0rc16, <= 1.0.0rc16 or >= 1.0.0rc17, <= 1.0.0rc17 or >= 1.0.0rc18, <= 1.0.0rc18 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.0rc4, <= 1.0.0rc4 or >= 1.0.0rc6, <= 1.0.0rc6 or >= 1.0.0rc7, <= 1.0.0rc7 or >= 1.0.0rc8, <= 1.0.0rc8 or >= 1.0.0rc9, <= 1.0.0rc9 or >= 1.0.1, <= 1.0.1 or >= 1.0.1rc1, <= 1.0.1rc1 or >= 1.0.2, <= 1.0.2 or >= 1.0.2rc1, <= 1.0.2rc1 or >= 1.0.2rc2, <= 1.0.2rc2 or >= 1.0.2rc3, <= 1.0.2rc3 or >= 1.0.3, <= 1.0.3 or >= 1.0.3rc1, <= 1.0.3rc1 or >= 1.0.3rc2, <= 1.0.3rc2 or >= 1.0.4, <= 1.0.4 or >= 1.0.4rc1, <= 1.0.4rc1 or >= 1.0.5, <= 1.0.5 or >= 1.0.5rc1, <= 1.0.5rc1 or >= 1.0.5rc2, <= 1.0.5rc2 or >= 1.0.5rc3, <= 1.0.5rc3 or >= 1.0.5rc4, <= 1.0.5rc4 or >= 1.0.5rc5, <= 1.0.5rc5 or >= 1.0.6, <= 1.0.6 or >= 1.0.6rc1, <= 1.0.6rc1 or >= 1.0.6rc2, <= 1.0.6rc2 or >= 1.0.6rc3, <= 1.0.6rc3 or >= 1.0.7rc1, <= 1.0.7rc1 or < 1.0.7 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.3.2, <= 0.3.2 or >= 0.3.4, <= 0.3.4 or >= 0.3.5, <= 0.3.5 or >= 0.3.6, <= 0.3.6 or >= 0.3.7, <= 0.3.7 or >= 0.3.8, <= 0.3.8 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.4, <= 0.9.4 or >= 0.9.5, <= 0.9.5 or >= 0.9.6, <= 0.9.6 or >= 0.9.7, <= 0.9.7 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc10, <= 1.0.0rc10 or >= 1.0.0rc11, <= 1.0.0rc11 or >= 1.0.0rc12, <= 1.0.0rc12 or >= 1.0.0rc13, <= 1.0.0rc13 or >= 1.0.0rc14, <= 1.0.0rc14 or >= 1.0.0rc15, <= 1.0.0rc15 or >= 1.0.0rc16, <= 1.0.0rc16 or >= 1.0.0rc17, <= 1.0.0rc17 or >= 1.0.0rc18, <= 1.0.0rc18 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.0rc4, <= 1.0.0rc4 or >= 1.0.0rc6, <= 1.0.0rc6 or >= 1.0.0rc7, <= 1.0.0rc7 or >= 1.0.0rc8, <= 1.0.0rc8 or >= 1.0.0rc9, <= 1.0.0rc9 or >= 1.0.1, <= 1.0.1 or >= 1.0.1rc1, <= 1.0.1rc1 or >= 1.0.2, <= 1.0.2 or >= 1.0.2rc1, <= 1.0.2rc1 or >= 1.0.2rc2, <= 1.0.2rc2 or >= 1.0.2rc3, <= 1.0.2rc3 or >= 1.0.3, <= 1.0.3 or >= 1.0.3rc1, <= 1.0.3rc1 or >= 1.0.3rc2, <= 1.0.3rc2 or >= 1.0.4, <= 1.0.4 or >= 1.0.4rc1, <= 1.0.4rc1 or >= 1.0.5, <= 1.0.5 or >= 1.0.5rc1, <= 1.0.5rc1 or >= 1.0.5rc2, <= 1.0.5rc2 or >= 1.0.5rc3, <= 1.0.5rc3 or >= 1.0.5rc4, <= 1.0.5rc4 or >= 1.0.5rc5, <= 1.0.5rc5 or >= 1.0.6, <= 1.0.6 or >= 1.0.6rc1, <= 1.0.6rc1 or >= 1.0.6rc2, <= 1.0.6rc2 or >= 1.0.6rc3, <= 1.0.6rc3 or >= 1.0.7rc1, <= 1.0.7rc1 or < 1.0.4 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.3.2, <= 0.3.2 or >= 0.3.4, <= 0.3.4 or >= 0.3.5, <= 0.3.5 or >= 0.3.6, <= 0.3.6 or >= 0.3.7, <= 0.3.7 or >= 0.3.8, <= 0.3.8 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.4, <= 0.9.4 or >= 0.9.5, <= 0.9.5 or >= 0.9.6, <= 0.9.6 or >= 0.9.7, <= 0.9.7 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc10, <= 1.0.0rc10 or >= 1.0.0rc11, <= 1.0.0rc11 or >= 1.0.0rc12, <= 1.0.0rc12 or >= 1.0.0rc13, <= 1.0.0rc13 or >= 1.0.0rc14, <= 1.0.0rc14 or >= 1.0.0rc15, <= 1.0.0rc15 or >= 1.0.0rc16, <= 1.0.0rc16 or >= 1.0.0rc17, <= 1.0.0rc17 or >= 1.0.0rc18, <= 1.0.0rc18 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.0rc4, <= 1.0.0rc4 or >= 1.0.0rc6, <= 1.0.0rc6 or >= 1.0.0rc7, <= 1.0.0rc7 or >= 1.0.0rc8, <= 1.0.0rc8 or >= 1.0.0rc9, <= 1.0.0rc9 or >= 1.0.1, <= 1.0.1 or >= 1.0.1rc1, <= 1.0.1rc1 or >= 1.0.2, <= 1.0.2 or >= 1.0.2rc1, <= 1.0.2rc1 or >= 1.0.2rc2, <= 1.0.2rc2 or >= 1.0.2rc3, <= 1.0.2rc3 or >= 1.0.3, <= 1.0.3 or >= 1.0.3rc1, <= 1.0.3rc1 or >= 1.0.3rc2, <= 1.0.3rc2 or >= 1.0.4rc1, <= 1.0.4rc1 or < 1.0.4 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.1.3, <= 0.1.3 or >= 0.1.4, <= 0.1.4 or >= 0.1.5, <= 0.1.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.7, <= 0.1.7 or >= 0.1.8, <= 0.1.8 or >= 0.1.9, <= 0.1.9 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.3.0, <= 0.3.0 or >= 0.3.1, <= 0.3.1 or >= 0.3.2, <= 0.3.2 or >= 0.3.4, <= 0.3.4 or >= 0.3.5, <= 0.3.5 or >= 0.3.6, <= 0.3.6 or >= 0.3.7, <= 0.3.7 or >= 0.3.8, <= 0.3.8 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.4.4, <= 0.4.4 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.4, <= 0.9.4 or >= 0.9.5, <= 0.9.5 or >= 0.9.6, <= 0.9.6 or >= 0.9.7, <= 0.9.7 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc10, <= 1.0.0rc10 or >= 1.0.0rc11, <= 1.0.0rc11 or >= 1.0.0rc12, <= 1.0.0rc12 or >= 1.0.0rc13, <= 1.0.0rc13 or >= 1.0.0rc14, <= 1.0.0rc14 or >= 1.0.0rc15, <= 1.0.0rc15 or >= 1.0.0rc16, <= 1.0.0rc16 or >= 1.0.0rc17, <= 1.0.0rc17 or >= 1.0.0rc18, <= 1.0.0rc18 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.0rc4, <= 1.0.0rc4 or >= 1.0.0rc6, <= 1.0.0rc6 or >= 1.0.0rc7, <= 1.0.0rc7 or >= 1.0.0rc8, <= 1.0.0rc8 or >= 1.0.0rc9, <= 1.0.0rc9 or >= 1.0.1, <= 1.0.1 or >= 1.0.1rc1, <= 1.0.1rc1 or >= 1.0.2, <= 1.0.2 or >= 1.0.2rc1, <= 1.0.2rc1 or >= 1.0.2rc2, <= 1.0.2rc2 or >= 1.0.2rc3, <= 1.0.2rc3 or >= 1.0.3, <= 1.0.3 or >= 1.0.3rc1, <= 1.0.3rc1 or >= 1.0.3rc2, <= 1.0.3rc2 or >= 1.0.4rc1, <= 1.0.4rc1

Patched version

1.0.7

An early warning has been issued for a vulnerability in the djust package that could lead to data disclosure across tenants. Users of affected versions should take immediate action.

What happened

An early warning has been issued regarding a vulnerability in the djust package. The issue reportedly involves the multi-tenant isolation mechanism failing on WebSocket/SSE paths, which could lead to data disclosure across tenants. This appears to be due to the current tenant not being set properly on non-HTTP paths. The vulnerability has been tracked under GHSA-3492-CVG7-9MR2 and GHSA-XHHM-F6HP-2QWJ.

The affected versions of the djust package include all versions less than 1.0.7 and various other versions as specified in the threat data. The recommended action is to upgrade to djust 1.0.7 or later to resolve the data disclosure issue.

What to do about it

• Identify if your project is using the djust package and check the version.
• If you are using an affected version, upgrade to djust 1.0.7 or later immediately.
• Test your application thoroughly after the upgrade to ensure the vulnerability has been addressed.
• Monitor the primary sources for any updates or additional information regarding this vulnerability.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [GHSA-xhhm-f6hp-2qwj] djust has an authorization bypass on the WebSocket/SSE mount path
• [GHSA-3492-cvg7-9mr2] djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
• [GHSA-4mf4-73j6-mvrw] djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Join the 0Day waitlist →

← Back to all threats