CVE-2026-31815
Medium
Description
Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.
SeverityMedium
CVSS5.3
Exploit probability—
ProductUnicorn
PublishedMar 10, 2026
First seenMar 10, 2026
Weakness typeCWE-284Improper access controlCWE-915CWE-915
How to fix
Update
- django-unicorn unicorn0.67.0 or later
- django-unicorn0.67.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| django-unicorn unicorn | v < 0.67.0 | 0.67.0 |
| django-unicornPyPI | v < 0.67.0 | 0.67.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.