CVE-2026-1287

MEDIUM

Django 4.2-4.2.27, 5.2-5.2.10, 6.0-6.0.1 - SQL Injection via FilteredRelation Column Aliases

Title source: llm
STIX 2.1

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

References (15)

Core 15
Core References
Vendor Advisory, Patch vendor-advisory
https://docs.djangoproject.com/en/dev/releases/security/
Release Notes mailing-list
https://groups.google.com/g/django-announce

Scores

CVSS v3 5.4
EPSS 0.0075
EPSS Percentile 50.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (10)
djangoproject/django 4.2 - 4.2.28
djangoproject/Django 4.2 - 4.2.28
djangoproject/Django 4.2.28
djangoproject/Django 5.2 - 5.2.11
djangoproject/Django 5.2.11
djangoproject/Django 6.0 - 6.0.2
djangoproject/Django 6.0.2
pypi/Django 4.2a1 - 4.2.28PyPI
pypi/Django 5.2a1 - 5.2.11PyPI
pypi/Django 6.0a1 - 6.0.2PyPI
Published Feb 03, 2026
Tracked Since Feb 18, 2026