## djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

- 種別: advisory
- 重大度: low
- 関連技術: python
- CVE: CVE-2026-113731
- 公開日時: 2026-10-21T17:21:15.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-r57g-mc79-8hj2)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-r57g-mc79-8hj2

影響: pip:djust >= 0.9.0, <= 1.0.9 → 1.0.10, pip:djust >= 1.1.0, <= 1.1.6 → 1.1.7, pip:djust >= 1.2.0.dev0, <= 1.2.3 → 1.2.4, pip:djust >= 1.3.0.dev0, <= 1.3.0rc7 → 1.3.0rc8
Affected version / file / line Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool() def find_handlers_for_template(template_path: str) -> str: """ Args: template_path: Either a logical template name (e.g. 'demos/counter.html' — what you'd pass to render) OR an absolute filesystem path. Both a…