The vulnerability allows an attacker to request any absolute file path via the legacy find_handlers_for_template MCP tool and have the server read a portion of the file. The returned data consists of substrings that match specific attribute patterns such as dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup, rather than the entire file contents. This prevents full arbitrary content disclosure but still permits the attacker to infer the presence and basic structure of sensitive files, thereby leaking potentially confidential information.

This flaw exists in the djust project (djust-org:djust). All releases from 0.9.0 up through 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8 are impacted. The MCP tool resides in python/djust/mcp/server.py and is used for Phoenix‑LiveView style reactive server‑side rendering in Django.

The CVSS score is 3.3, indicating low severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local MCP client that communicates over stdio as the same operating‑system user; there is no network exposure. An attacker with local user privileges can use the tool as a file‑existence oracle and read limited substrings from files readable by the djust process. The overall risk is moderate because the data exposed is limited but could reveal sensitive patterns.