Django · Django · CVE-2026-1312
**Name of the Vulnerable Software and Affected Versions**
Django versions 6.0 through 6.0.1
Django versions 5.2 through 5.2.10
Django versions 4.2 through 4.2.27
Django versions 5.0.x and earlier
Django versions 4.1.x and earlier
Django versions 3.2.x and earlier
**Description**
The `.QuerySet.order by()` function is susceptible to SQL injection when column aliases contain periods, particularly when a crafted dictionary is used with dictionary expansion within a `FilteredRelation`. This can occur when the same alias is utilized. Earlier, unsupported Django series, including versions 5.0.x, 4.1.x, and 3.2.x, may also be affected.
**Recommendations**
Update to Django version 6.0.2 or later.
Update to Django version 5.2.11 or later.
Update to Django version 4.2.28 or later.