CVE-2026-113731: djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

@mcp.tool()
def find_handlers_for_template(template_path: str) -> str:
"""
Args:
template_path: Either a logical template name (e.g.
'demos/counter.html' — what you'd pass to `render`) OR
an absolute filesystem path. Both are searched.
"""
...
resolved_path: str | None = None
if os.path.isabs(template_path) and os.path.isfile(template_path):
resolved_path = template_path
else:
...  # logical-name resolution via Django's template loader
...
with open(resolved_path, "r", encoding="utf-8", errors="replace") as f:
source = f.read()
handler_names_in_template = sorted({m.group(2) for m in dj_event_attr_re.finditer(source)})

When template_path is an absolute path to an existing file, it is used directly, with no confinement to the project/template directories — no realpath() + prefix check, no allowlist. open(resolved_path, …) then reads the file.

This is inconsistent with the sibling tool in the same file (loaddata, ~line 290-303), which explicitly rejects paths outside the project directory for its own path-like parameter:

candidate = os.path.realpath(...)
if base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):
return json.dumps({"error": f"fixture path '{p}' resolves outside the project directory", ...})

find_handlers_for_template has no equivalent check for template_path before the open() call.