Executive brief
Django is a popular web framework used to build and manage websites. A security flaw in how it handles database queries could allow an attacker to execute unauthorized database commands. This could lead to the exposure of sensitive information or unauthorized changes to data stored in the application's database.
Technical details
A SQL injection vulnerability exists in Django's FilteredRelation component. The issue occurs when control characters are used in column aliases within a crafted dictionary passed via keyword arguments (**kwargs) to QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). An attacker with the ability to influence these arguments could inject malicious SQL commands. The vulnerability is fixed in versions 6.0.2, 5.2.11, and 4.2.28. Unsupported versions like 5.0.x and 3.2.x may also be affected but were not specifically evaluated.
Affected products
- Django Software Foundation Django 6.0 before 6.0.2, 5.2 before 5.2.11, 4.2 before 4.2.28
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched
- 2026-02-03: advisory
References
- https://pypi.org/project/Django/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
- https://access.redhat.com/errata/RHSA-2026:14835
- https://access.redhat.com/errata/RHSA-2026:2694
- https://access.redhat.com/errata/RHSA-2026:3958