Vulnerability-Lookup

CVE-2026-31815 (GCVE-0-2026-31815)

Vulnerability from cvelistv5 – Published: 2026-03-10 21:07 – Updated: 2026-03-11 14:18

Title

django-unicorn affected by component state manipulation via unvalidated attribute access

Summary

Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-284 - Improper Access Control
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

GitHub_M

References

URL

Tags

https://github.com/django-commons/django-unicorn/…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	django-commons	django-unicorn	Affected: < 0.67.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31815",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T14:17:42.872101Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T14:18:26.595Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "django-unicorn",
          "vendor": "django-commons",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.67.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-10T21:07:08.198Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367"
        }
      ],
      "source": {
        "advisory": "GHSA-ffv6-jj46-x367",
        "discovery": "UNKNOWN"
      },
      "title": "django-unicorn affected by component state manipulation via unvalidated attribute access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31815",
    "datePublished": "2026-03-10T21:07:08.198Z",
    "dateReserved": "2026-03-09T16:33:42.914Z",
    "dateUpdated": "2026-03-11T14:18:26.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31815",
      "date": "2026-04-25",
      "epss": "0.00099",
      "percentile": "0.27339"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31815\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-10T22:16:19.000\",\"lastModified\":\"2026-03-18T19:36:52.713\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.\"},{\"lang\":\"es\",\"value\":\"Unicorn a\u00f1ade funcionalidad de componente reactivo moderno a tus plantillas de Django. Antes de la versi\u00f3n 0.67.0, la manipulaci\u00f3n del estado del componente es posible en django-unicorn debido a la falta de comprobaciones de control de acceso durante las actualizaciones de propiedades y las llamadas a m\u00e9todos. Un atacante puede eludir la protecci\u00f3n _is_public prevista para modificar atributos internos como template_name o activar m\u00e9todos protegidos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.67.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"},{\"lang\":\"en\",\"value\":\"CWE-915\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:django-unicorn:unicorn:*:*:*:*:*:django:*:*\",\"versionEndExcluding\":\"0.67.0\",\"matchCriteriaId\":\"4824A04E-42A4-440A-BE05-1CF5473B9545\"}]}]}],\"references\":[{\"url\":\"https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-31815\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-11T14:17:42.872101Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-11T14:18:22.134Z\"}}], \"cna\": {\"title\": \"django-unicorn affected by component state manipulation via unvalidated attribute access\", \"source\": {\"advisory\": \"GHSA-ffv6-jj46-x367\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"django-commons\", \"product\": \"django-unicorn\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.67.0\"}]}], \"references\": [{\"url\": \"https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367\", \"name\": \"https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-915\", \"description\": \"CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-10T21:07:08.198Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-31815\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-11T14:18:26.595Z\", \"dateReserved\": \"2026-03-09T16:33:42.914Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-10T21:07:08.198Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-31815

Vulnerability from fkie_nvd - Published: 2026-03-10 22:16 - Updated: 2026-03-18 19:36

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	django-unicorn	unicorn	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:django-unicorn:unicorn:*:*:*:*:*:django:*:*",
              "matchCriteriaId": "4824A04E-42A4-440A-BE05-1CF5473B9545",
              "versionEndExcluding": "0.67.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0."
    },
    {
      "lang": "es",
      "value": "Unicorn a\u00f1ade funcionalidad de componente reactivo moderno a tus plantillas de Django. Antes de la versi\u00f3n 0.67.0, la manipulaci\u00f3n del estado del componente es posible en django-unicorn debido a la falta de comprobaciones de control de acceso durante las actualizaciones de propiedades y las llamadas a m\u00e9todos. Un atacante puede eludir la protecci\u00f3n _is_public prevista para modificar atributos internos como template_name o activar m\u00e9todos protegidos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.67.0."
    }
  ],
  "id": "CVE-2026-31815",
  "lastModified": "2026-03-18T19:36:52.713",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-10T22:16:19.000",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-FFV6-JJ46-X367

Vulnerability from github – Published: 2026-03-11 00:11 – Updated: 2026-03-11 05:45

Summary

django-unicorn affected by component state manipulation via unvalidated attribute access

Details

Summary

Component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods.

Vulnerability Details: Component Access Control Bypass

Security analysis identified that the framework fails to enforce visibility boundaries defined by _is_public within the action parsers. Specifically, the logic in set_property_value() and _call_method_name() utilizes getattr and setattr directly on component instances without verifying if the target attribute or method is explicitly marked as public.

Vulnerability resides in: - src/django_unicorn/views/action_parsers/call_method.py - src/django_unicorn/views/action_parsers/utils.py

While Django's template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from other installed applications or reset the component state by invoking the internal reset() method.

Proof of Concept (PoC)

Attacker can overwrite the template_name attribute by sending a crafted JSON payload to the message endpoint:

Construct a payload targeting a protected attribute: json { "actionQueue": [ { "type": "syncInput", "payload": { "name": "template_name", "value": "admin/base.html" } } ], "data": {}, "meta": "<checksum_of_empty_dict>" }
The server-side component updates its internal state: self.template_name = "admin/base.html".
Subsequent re-rendering displays the content of the targeted template, bypassing intended component logic.

Impact

Low severity. The risk is limited to unauthorized manipulation of component state and rendering of existing templates within the application's configured template directories. Remote Code Execution (RCE) is not possible via this vector.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-unicorn"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.67.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-31815"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T00:11:08Z",
    "nvd_published_at": "2026-03-10T22:16:19Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nComponent state manipulation is possible in `django-unicorn` due to missing access control checks during property updates and method calls. An attacker can bypass the intended `_is_public` protection to modify internal attributes such as `template_name` or trigger protected methods.\n\n## Vulnerability Details: Component Access Control Bypass\nSecurity analysis identified that the framework fails to enforce visibility boundaries defined by `_is_public` within the action parsers. Specifically, the logic in `set_property_value()` and `_call_method_name()` utilizes `getattr` and `setattr` directly on component instances without verifying if the target attribute or method is explicitly marked as public.\n\nVulnerability resides in:\n- `src/django_unicorn/views/action_parsers/call_method.py`\n- `src/django_unicorn/views/action_parsers/utils.py`\n\nWhile Django\u0027s template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from other installed applications or reset the component state by invoking the internal `reset()` method.\n\n## Proof of Concept (PoC)\nAttacker can overwrite the `template_name` attribute by sending a crafted JSON payload to the message endpoint:\n\n1. Construct a payload targeting a protected attribute:\n   ```json\n   {\n     \"actionQueue\": [\n       {\n         \"type\": \"syncInput\",\n         \"payload\": { \"name\": \"template_name\", \"value\": \"admin/base.html\" }\n       }\n     ],\n     \"data\": {},\n     \"meta\": \"\u003cchecksum_of_empty_dict\u003e\"\n   }\n   ```\n2. The server-side component updates its internal state: `self.template_name = \"admin/base.html\"`.\n3. Subsequent re-rendering displays the content of the targeted template, bypassing intended component logic.\n\n## Impact\nLow severity. The risk is limited to unauthorized manipulation of component state and rendering of existing templates within the application\u0027s configured template directories. Remote Code Execution (RCE) is not possible via this vector.",
  "id": "GHSA-ffv6-jj46-x367",
  "modified": "2026-03-11T05:45:51Z",
  "published": "2026-03-11T00:11:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31815"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django-commons/django-unicorn"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "django-unicorn affected by component state manipulation via unvalidated attribute access"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-31815 (GCVE-0-2026-31815)

FKIE_CVE-2026-31815

GHSA-FFV6-JJ46-X367

Summary

Vulnerability Details: Component Access Control Bypass

Proof of Concept (PoC)

Impact

Tags

Sightings

Nomenclature