CVE-2026-31815: Django-Unicorn Unicorn

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.

Affected products

• Django-Unicorn Unicorn: before 0.67.0 (fixed in 0.67.0)

Published 2026-03-10. Last modified 2026-06-17.