GHSA-mjgh-79qc-68w3

Suggest an improvement
Source
https://github.com/advisories/GHSA-mjgh-79qc-68w3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mjgh-79qc-68w3/GHSA-mjgh-79qc-68w3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mjgh-79qc-68w3
Aliases
Downstream
Related
Published
2026-03-03T15:31:41Z
Modified
2026-03-06T19:44:14.996605Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Django has a Race Condition vulnerability
Details

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary umask change affects other threads in multi-threaded environments.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-04T20:24:29Z",
    "severity": "LOW",
    "nvd_published_at": "2026-03-03T15:16:19Z",
    "cwe_ids": [
        "CWE-362"
    ]
}
References

Affected packages

PyPI / django

Package

Name
django
View open source insights on deps.dev
Purl
pkg:pypi/django

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0
Fixed
6.0.3

Affected versions

6.*
6.0
6.0.1
6.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mjgh-79qc-68w3/GHSA-mjgh-79qc-68w3.json"

PyPI / django

Package

Name
django
View open source insights on deps.dev
Purl
pkg:pypi/django

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2
Fixed
5.2.12

Affected versions

5.*
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.2.10
5.2.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mjgh-79qc-68w3/GHSA-mjgh-79qc-68w3.json"

PyPI / django

Package

Name
django
View open source insights on deps.dev
Purl
pkg:pypi/django

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2
Fixed
4.2.29

Affected versions

4.*
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.2.9
4.2.10
4.2.11
4.2.12
4.2.13
4.2.14
4.2.15
4.2.16
4.2.17
4.2.18
4.2.19
4.2.20
4.2.21
4.2.22
4.2.23
4.2.24
4.2.25
4.2.26
4.2.27
4.2.28

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mjgh-79qc-68w3/GHSA-mjgh-79qc-68w3.json"