Executive brief
A vulnerability was found in the Django web framework specifically affecting applications using PostGIS for geographic data. An attacker could potentially execute unauthorized database commands, which could lead to the theft or modification of sensitive information. This issue is resolved in the latest security updates for supported Django versions.
Technical details
A SQL injection vulnerability exists in Django's GIS module specifically during raster lookups on 'RasterField'. The flaw is located in the band index parameter, which is only implemented on the PostGIS backend. A remote attacker with the ability to influence these lookups can inject malicious SQL commands. The issue affects Django versions 6.0.x, 5.2.x, and 4.2.x; older unsupported versions like 5.0.x and 3.2.x may also be vulnerable. Patches are available in versions 6.0.2, 5.2.11, and 4.2.28.
Affected products
- Django Software Foundation Django 6.0 before 6.0.2, 5.2 before 5.2.11, 4.2 before 4.2.28
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched
- 2026-02-03: advisory
References
- https://pypi.org/project/Django/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
- https://access.redhat.com/errata/RHSA-2026:14835
- https://access.redhat.com/errata/RHSA-2026:2694
- https://access.redhat.com/errata/RHSA-2026:3958