{"id":"ghsa-ghsa-r57g-mc79-8hj2","seq":32727,"kind":"advisory","title":"djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool","url":"https://github.com/advisories/GHSA-r57g-mc79-8hj2","permalink":"https://vulnpulse.app/items/ghsa-ghsa-r57g-mc79-8hj2","summary":"影響: pip:djust >= 0.9.0, <= 1.0.9 → 1.0.10, pip:djust >= 1.1.0, <= 1.1.6 → 1.1.7, pip:djust >= 1.2.0.dev0, <= 1.2.3 → 1.2.4, pip:djust >= 1.3.0.dev0, <= 1.3.0rc7 → 1.3.0rc8\nAffected version / file / line Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool() def find_handlers_for_template(template_path: str) -> str: \"\"\" Args: template_path: Either a logical template name (e.g. 'demos/counter.html' — what you'd pass to render) OR an absolute filesystem path. Both a…","severity":"low","techs":["python"],"cves":["CVE-2026-113731"],"tags":["GHSA-r57g-mc79-8hj2","djust","djust","djust","djust"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T17:21:15.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}