CVE-2026-113731 djust-org CVE debrief

Who should care

Defenders responsible for systems using the djust package, especially in environments where file access could lead to security issues, should be aware of this vulnerability and take steps to verify and mitigate exposure.

Why it matters

CVE-2026-113731 is an arbitrary absolute-path file read vulnerability in the djust package's find_handlers_for_template MCP tool. Defenders should verify djust package versions, review system configurations for exposure, and update to fixed versions to prevent potential unauthorized file access and data exposure.

• Potential unauthorized file access and data exposure.
• Possible use in attacks requiring file access for further exploitation.
• Need for verification of djust package versions and system configurations.
• Importance of updating to fixed versions to prevent exploitation.

Technical summary

The find_handlers_for_template MCP tool in the djust package allows for arbitrary absolute-path file reads when provided with an absolute path to an existing file. This is due to a lack of proper confinement checks, allowing for direct file access without restrictions. The affected versions of the djust package range from 0.9.0 to 1.3.0rc7, with fixes available in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8. Defenders should verify djust package versions, review system configurations for exposure, and update to fixed versions to prevent potential unauthorized file access and data exposure.

Defensive priority

Defenders should prioritize verifying the versions of the djust package in use and updating to fixed versions as soon as possible. They should also review their systems for potential exposure, especially if the djust package is used in environments where file access could lead to security issues.

Recommended defensive actions

• Verify the version of the djust package in use and update to a fixed version if necessary.
• Review system configurations for potential exposure, especially in environments where file access could lead to security issues.
• Monitor systems for any suspicious activity that could be related to this vulnerability.
• Perform a thorough review of system logs to identify potential exploitation attempts.
• Conduct an asset inventory to ensure all affected systems are accounted for.
• Establish a rollback change window for systems that cannot be immediately patched.
• Track changes and updates to the djust package for future security advisories.

Evidence notes

The evidence for this vulnerability comes from the official CVE record and the source item provided by osv_dev. The details of the vulnerability, including the affected versions and the nature of the issue, are based on the information supplied in these sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.