CVE-2026-31815

django-unicorn affected by component state manipulation via unvalidated attribute access

Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.

Affected

django-commons · django-unicorn

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v3.1 GITHUB

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2026-03-10

Updated

2026-03-11

Proof-of-concept exploits (1)

• advisories/GHSA-ffv6-jj46-x367

Security advisories

• django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367

References

• CVE Record
• NVD entry