scjody/django-session-csrf — comment on commit 4b92d9d2c6fd6faeb3c35b3b7766272b4cffa4e9
File:  line 0
By scjody:

I don't understand the vulnerability here. We still don't rely on the CSRF_COOKIE from the client for anything (the key used for CSRF checks comes from the session or the cache as usual) so the attacker can set CSRF_COOKIE if he wants but it won't do any good.

There is a vulnerability if the attacker can _read_ the cookie jar, but then he could just steal the session cookie.