{"action":"Upgrade djust to 1.0.10 or later.","affected":[{"fixed":"1.0.10","introduced":"0.9.0"},{"fixed":"1.1.7","introduced":"1.1.0"},{"fixed":"1.2.4","introduced":"1.2.0.dev0"},{"introduced":"1.3.0.dev0"}],"component":"djust","cve_ids":["CVE-2026-113731"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.0.10","1.1.7","1.2.4","1.3.0rc8"],"ghsa_id":"GHSA-r57g-mc79-8hj2","id":"tcs_01M5JKTA2HRB7JR8KCSN8GN5JM","modified_at":"2026-10-21T17:35:19.934118290Z","published_at":"2026-10-21T17:21:15Z","references":["https://osv.dev/vulnerability/GHSA-r57g-mc79-8hj2","https://github.com/djust-org/djust/security/advisories/GHSA-r57g-mc79-8hj2","https://nvd.nist.gov/vuln/detail/CVE-2026-113731","https://github.com/djust-org/djust/commit/45a5045793ebe7c9c2df86b0ad34275af6822619","https://github.com/djust-org/djust/commit/744bccf699c65c815d9379b36236a7c5592a339b","https://github.com/djust-org/djust/commit/85eed7caaf620bdb08986f2f3bb79432c0d3d715","https://github.com/djust-org/djust/commit/a62caf6b4ef540ad688d4dfdfa407ff914c78728","https://github.com/djust-org/djust","https://github.com/djust-org/djust/releases/tag/v1.0.10","https://github.com/djust-org/djust/releases/tag/v1.1.7","https://github.com/djust-org/djust/releases/tag/v1.2.4","https://github.com/djust-org/djust/releases/tag/v1.3.0rc8"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-r57g-mc79-8hj2","url":"https://osv.dev/vulnerability/GHSA-r57g-mc79-8hj2"}],"summary":"djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool"}