BIT-django-2026-1312

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-1312.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-django-2026-1312

Aliases

Published

2026-02-05T08:38:43.002Z

Modified

2026-02-05T10:26:13.574487Z

Summary

Potential SQL injection via QuerySet.order_by and FilteredRelation

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.order_by() is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

Database specific

{
    "cpes": [
        "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / django

Package

Name: django
Purl: pkg:bitnami/django

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

4.2.0

Fixed

4.2.28

Introduced

5.2.0

Fixed

5.2.11

Introduced

6.0.0

Fixed

6.0.2

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-1312.json"