Medium severity5.3NVD Advisory· Published Mar 10, 2026· Updated Jun 17, 2026
CVE-2026-31815
CVE-2026-31815
Description
Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
django-unicornPyPI | < 0.67.0 | 0.67.0 |
Affected products
3- Range: < 0.67.0
Patches
Vulnerability mechanics
References
3- github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-ffv6-jj46-x367ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-31815ghsaADVISORY
News mentions
0No linked articles in our index yet.