An unauthenticated remote code execution vulnerability in the djust framework allows attackers to trigger arbitrary Python module imports and execute top-level code.

The vulnerability exists in the djust live transport, which insecurely uses __import__ on client-supplied paths before verifying authentication or class types. An unauthenticated attacker can send crafted WebSocket frames to force the server to import and execute any available Python module.

Successful exploitation of this flaw allows an unauthenticated attacker to execute arbitrary code within the context of the web application. This could lead to full system compromise, unauthorized data access, or the disruption of critical services. Given the high CVSS score of 8.8, immediate remediation is required to prevent potential exploitation.

Immediate Action: Upgrade the djust package to version 1.0.7 or later, which implements a fail-closed resolution gate to prevent unauthorized module imports.

Proactive Monitoring: Monitor server logs and WebSocket traffic for unexpected module import attempts or abnormal application behavior originating from unauthenticated sessions.

Compensating Controls: If an immediate upgrade is not feasible, restrict LIVEVIEW_ALLOWED_MODULES to only the necessary modules, though note this is a mitigation and not a complete security fix.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the lack of authentication during the vulnerable operation, poses a significant risk to any application utilizing the djust framework. Administrators must prioritize updating to version 1.0.7 immediately to eliminate the underlying injection vector and secure the application against remote exploitation.