Detections
Analytics
CVE-2026-31815
medium
Description
Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.
References
https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367