Django 4.2-4.2.27, 5.2-5.2.10, 6.0-6.0.1 - SQL Injection via QuerySet.order_by() with FilteredRelation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-1312. PoCs published by alpinine, sw0rd1ight.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2026-1312, demonstrating the vulnerability in Django by running regression tests before and after the fix. It uses Docker to isolate the test environment and logs results for analysis.
Description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.
Exploits (2)
This repository contains a functional PoC for CVE-2026-1312, demonstrating the vulnerability in Django by running regression tests before and after the fix. It uses Docker to isolate the test environment and logs results for analysis.
This repository contains a functional proof-of-concept for CVE-2026-1312, a Django SQL injection vulnerability. The exploit demonstrates how malicious SQL can be injected via the `order_by()` method when using `FilteredRelation` with dynamically constructed queries.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N