5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31815

CVE-2026-31815: django-unicorn affected by component state manipulation via unvalidated attribute access

Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31815

CVE-2026-31815:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
django-unicorn	pip	< 0.67.0	0.67.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in django-unicorn (GHSA-ffv6-jj46-x367) stemmed from an improper access control weakness. The core of the issue was that the framework failed to validate whether properties and methods were public before modifying or executing them. The analysis of the security patches between the vulnerable version (0.66.1) and the patched version (0.67.0) confirms this.

The primary vulnerable functions were set_property_value and _call_method_name. These functions are responsible for handling component state updates and method calls triggered by frontend actions. Before the patch, they would directly use setattr and getattr on component objects based on user-provided input from the action queue. This allowed an attacker to craft a request to modify sensitive internal properties (like template_name) or call protected methods (like reset), bypassing the intended security model which relies on the _is_public check.

The patch, found in commit d8ab55392f2c9a18239271669360c322fdce7332, rectifies this by adding explicit checks using component._is_public() at the beginning of both set_property_value and _call_method_name. This ensures that only attributes and methods explicitly marked as public can be accessed.

A secondary, related vulnerability was fixed in set_property_from_data (commit f98816bbfb47e76cf6691ecca6e1cca1b2aec4ad) as a defense-in-depth measure. This function also lacked the _is_public check, creating another vector for unauthorized state modification. During exploitation, a stack trace would likely show calls to these functions when processing a malicious request.

Vulnerable functions

set_property_value

src/django_unicorn/views/action_parsers/utils.py

The function `set_property_value` was vulnerable because it directly used `setattr` on a component instance without first verifying if the target property was intended for public access. The patch adds a call to `component._is_public()` to ensure that only explicitly public properties can be modified, preventing attackers from overwriting internal state attributes like `template_name`.

_call_method_name

src/django_unicorn/views/action_parsers/call_method.py

The function `_call_method_name` was vulnerable as it used `getattr` to retrieve and execute any method on a component, without checking if the method was public. This allowed attackers to call internal methods (e.g., `reset`). The patch introduces a check with `component._is_public()` to ensure only public methods can be invoked.

set_property_from_data

src/django_unicorn/views/utils.py

As a defense-in-depth measure, `set_property_from_data` was also patched. This function updates a component's properties from the request's data dictionary. It was vulnerable because it did not validate if the properties being updated were public, creating a secondary pathway for an attacker to modify internal component state if they could manipulate the data dictionary.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.