CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2026-31815
Medium (5.3) in django-unicorn unicorn. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in django-unicorn 0.67.0.
Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-11-01)
- CWEs
- CWE-284, CWE-915
- Published
- Modified
- Record from
- the NVD, synced
Affected
- django-unicorn:unicorn
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ffv6-jj46-x367 | PyPI | django-unicorn | <0.67.0 | 0.67.0 |
| PYSEC-2026-2451 | PyPI | django-unicorn | <0.67.0 | 0.67.0 |