Executive brief
Django, a popular web framework for Python, is vulnerable to a security flaw that could allow an attacker to interfere with database queries. By providing specifically crafted data to certain database filtering functions, an attacker could potentially view or modify data they are not authorized to access. This issue affects applications using specific QuerySet features and has been addressed in recent security updates.
Technical details
A SQL injection vulnerability exists in Django's ORM layer. The issue occurs within `.QuerySet.order_by()` when handling column aliases containing periods, specifically when the same alias is used in a `FilteredRelation` via dictionary expansion with a suitably crafted dictionary. An attacker with the ability to influence these parameters could execute arbitrary SQL commands against the backend database. The vulnerability is present in Django versions 6.0.x, 5.2.x, and 4.2.x, and has been patched in versions 6.0.2, 5.2.11, and 4.2.28 respectively. Older unsupported versions like 5.0.x and 3.2.x may also be affected.
Affected products
- Django Software Foundation Django 6.0 before 6.0.2, 5.2 before 5.2.11, 4.2 before 4.2.28
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched
- 2026-02-03: advisory
References
- https://pypi.org/project/Django/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
- https://access.redhat.com/errata/RHSA-2026:14835
- https://access.redhat.com/errata/RHSA-2026:2694
- https://access.redhat.com/errata/RHSA-2026:3958