CVE-2026-31815 django-unicorn affected by component state manipulation via unvalidated attribute access
Attackers can bypass access controls to modify internal component attributes or trigger protected methods in django-unicorn.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31815?
CVE-2026-31815 is a medium-severity missing authorization vulnerability in django-commons django-unicorn, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.
Which versions are affected by CVE-2026-31815?
3 open source packages ship an affected version, including django-unicorn. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
django-unicorn PyPI | All versions | 0.67.0 |
django-unicorn PyPI | All versions | 0.67.0 |
django-unicorn PyPI | All versions | 0.67.0 |
Products include Django-Unicorn Unicorn.
How do I fix CVE-2026-31815?
Upgrade django-unicorn to 0.67.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-31815 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31815 exists.
Other vulnerabilities in django-commons django-unicorn
Sources
Also known as GHSA-ffv6-jj46-x367, PYSEC-2026-2451.