Add advisory for django-async-include RCE (CVSS 9.8)

vulns/django-async-include/PYSEC-0000-django-async-include-rce.yaml

@@ -0,0 +1,73 @@
+id: PYSEC-0000-django-async-include-rce
+modified: "2026-06-03T00:00:00Z"
+published: "2026-06-03T00:00:00Z"
+schema_version: "1.6.0"
+
+aliases: []
+
+summary: >
+  Unauthenticated Remote Code Execution in django-async-include via unsafe jsonpickle deserialization
+
+details: |
+  django-async-include versions prior to 0.8.0 are vulnerable to unauthenticated 
+  remote code execution. The package uses `jsonpickle.loads()` to deserialize 
+  untrusted user input from HTTP request bodies in `async_include/views.py` at 
+  line 25. The vulnerable endpoint is accessible without authentication at the 
+  URL path `/async_include/get/%3F`.
+
+  An attacker can craft a malicious JSON payload using jsonpickle's `py/reduce` 
+  gadget to execute arbitrary Python code on the server. The deserialization 
+  occurs before any validation or authentication checks.
+
+  The vulnerability was fixed in version 0.8.0 by replacing `jsonpickle.loads()` 
+  with the safe `json.loads()` function.
+
+severity:
+  - type: CVSS_V3
+    score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+
+affected:
+  - package:
+      ecosystem: PyPI
+      name: django-async-include
+    ranges:
+      - type: ECOSYSTEM
+        events:
+          - introduced: "0"
+          - fixed: "0.8.0"
+    versions:
+      - "0.5.0"
+      - "0.5.1"
+      - "0.5.2"
+      - "0.5.3"
+      - "0.5.4"
+      - "0.5.5"
+      - "0.6.0"
+      - "0.6.1"
+      - "0.6.2"
+      - "0.6.3"
+      - "0.6.4"
+      - "0.6.5"
+      - "0.6.6"
+      - "0.7.0"
+    ecosystem_specific:
+      imports:
+        - attribute: "get"
+          modules:
+            - "async_include.views"
+
+references:
+  - type: PACKAGE
+    url: https://pypi.org/project/django-async-include/
+  - type: FIX
+    url: https://github.com/diegojromerolopez/django-async-include/releases/tag/v0.8.0
+
+credits:
+  - name: Igor Kakaroff (shred0day)
+    contact:
+      - mailto:igorkakaroff@gmail.com
+    type: FINDER
+  - name: Diego J. Romero López
+    contact:
+      - mailto:diegojromerolopez@gmail.com
+    type: REMEDIATION_DEVELOPER