djust: Arbitrary absolute-path file read in MCP tool

The find_handlers_for_template tool in djust v1.1.4 allows MCP clients to read arbitrary files on disk by passing absolute paths without directory confinement checks, potentially exposing sensitive files like /etc/passwd or .env files.

Disclosed 21 October 2026 · Record updated 21 October 2026

Impact

An MCP client can read arbitrary files on the server by passing absolute paths to find_handlers_for_template, with partial content extraction via regex matching against Django event handler attributes.

Our coverage

A robot's hand reaches through an open door into neighboring rooms, grabbing files from shelves it was never meant to access, while guards stand motionless at the threshold.

Vulnerabilities

MCP tool in djust reads files outside the project directory

A GitHub advisory published on 21 October 2026 says a djust tool opens any absolute file path an agent asks for, with no confinement check.

21 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-r57g-mc79-8hj2