PT-2026-6427 · Pypi · Django

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet methods annotate(), aggregate(), extra(), values(), values list(), and alias(). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-GVG8-93H5-G6QQ

Affected Products

Django

References · 7

• https://osv.dev/vulnerability/GHSA-gvg8-93h5-g6qq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1287 · Security Note
• https://github.com/django/django · Note
• https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22 · Note
• https://djangoproject.com/weblog/2026/feb/03/security-releases · Note
• https://docs.djangoproject.com/en/dev/releases/security · Note
• https://groups.google.com/g/django-announce · Note