PT-2026-6036 · Django+3 · Django+3
Jacob Walls
+2
·
Published
2026-02-03
·
Updated
2026-03-10
·
CVE-2026-1287
CVSS v4.0
8.1
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
Name of the Vulnerable Software and Affected Versions
Django versions 6.0 through 6.0.1
Django versions 5.2 through 5.2.10
Django versions 4.2 through 4.2.27
Django versions 5.0.x and earlier
Django versions 4.1.x and earlier
Django versions 3.2.x and earlier
Description
The
FilteredRelation component is susceptible to SQL injection in column aliases through the use of control characters. This occurs when a crafted dictionary is used with dictionary expansion as the **kwargs passed to the annotate(), aggregate(), extra(), values(), values list(), and alias() methods of QuerySet.Recommendations
Update to Django version 6.0.2 or later.
Update to Django version 5.2.11 or later.
Update to Django version 4.2.28 or later.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Django
Linuxmint
Red Os
Ubuntu