MCP tool in djust reads files outside the project directory

A security advisory published on 21 October 2026 says that djust, a Python package distributed on PyPI, ships an MCP tool that will open any file on disk the server process can read. The flaw is tracked as CVE-2026-113731 under GitHub advisory GHSA-r57g-mc79-8hj2 and affects djust v1.1.4, the latest release at the time, published on 23 September 2026.

MCP, the Model Context Protocol, is the interface that lets AI assistants call tools exposed by a running application. According to the advisory, the problem sits in the find_handlers_for_template tool in python/djust/mcp/server.py. The tool is documented as accepting either a logical Django template name or an absolute filesystem path. When the argument is an absolute path and the file exists, the code uses that path directly and opens it. The advisory says there is no realpath() plus prefix check and no allowlist confining the read to the project or template directories.

The advisory notes that a sibling tool in the same file, loaddata, does perform that check. It resolves its path argument and returns an error if the result falls outside the project directory. find_handlers_for_template has no equivalent guard before its open() call. The reporter suggests fixing it by copying the same confinement logic across.

The tool is available whenever a Django project runs the MCP server via python manage.py djust_mcp, the advisory says, with no separate opt-in flag gating this specific tool. Any MCP client with access to the tool can therefore name a file such as /etc/passwd, an application .env file or an SSH key and have the server read it.

What comes back is more limited than a full file dump, which is why the reporter rated the issue Medium rather than High. The tool does not return raw content. It runs one fixed regular expression over the file, looking for HTML-style attributes such as dj-click="...", and returns only the matched handler names. For most sensitive files, including /etc/passwd, nothing will match. But the response still confirms that the file exists and was readable, which the advisory describes as an existence and readability oracle in its own right: passing a non-existent absolute path returns "Template file not found" instead. If a targeted file does contain text shaped like key="value" — plausible in config files or logs, the reporter says — those substrings are returned verbatim.

The finding was made on 24 September 2026 during an audit and was confirmed by reading the source, the advisory says. The reporter is explicit about the limits of the work: no live Django or djust project was exercised, so this is a source-level trace of the executed branch rather than an end-to-end runtime capture. The report also says it did not check whether any MCP host would prompt a user before a tool call with a suspicious-looking path argument, adding that the missing server-side guard is the vulnerability regardless of client-side behaviour.

The advisory records the issue as reported, with a request to apply a CVE once a fix is made. The suggested patch inserts the project-directory check before the file-existence test, returning a JSON error that names the resolved path and the project directory when the two do not line up.