PT-2026-6375 · Pypi · Django

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

.QuerySet.order by() is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-6426-9FV3-65X8

Affected Products

Django

References · 8

• https://osv.dev/vulnerability/GHSA-6426-9fv3-65x8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1312 · Security Note
• https://github.com/django/django · Note
• https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84 · Note
• https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222 · Note
• https://djangoproject.com/weblog/2026/feb/03/security-releases · Note
• https://docs.djangoproject.com/en/dev/releases/security · Note
• https://groups.google.com/g/django-announce · Note