Executive brief
A vulnerability in the django-haystack search library allows attackers to execute arbitrary code on the server. This occurs when the application uses Elasticsearch and specific field configurations, allowing malicious data stored in the search index to be executed as Python code when search results are processed. An attacker who can contribute content to the search index (such as through a public form or API) could take full control of the application server.
Technical details
The Elasticsearch backend in django-haystack improperly handles field aliases during result processing. When a SearchField is defined with an 'index_fieldname' alias different from its logical name, the backend fails to map the alias back to the logical field name during result retrieval. This causes the value to fall through to the '_to_python()' method, which calls 'eval()' on the raw string value from Elasticsearch without validation. An attacker who can influence data indexed into Elasticsearch can inject Python expressions (e.g., using __import__('os').system) that execute in the context of the Django application process when a search returning that data is performed. The vulnerability is fixed in version 3.4.0 by implementing proper field mapping and replacing 'eval()' with 'ast.literal_eval()'.
Affected products
- django-haystack django-haystack < 3.4.0
Timeline
- 2026-06-04: disclosed
- 2026-07-15: advisory
References
- https://github.com/django-haystack/django-haystack/security/advisories/GHSA-r3hx-x5rh-p9vv
- https://github.com/django-haystack/django-haystack/commit/eb05f193c9771a68dcc8cfac6674a0d48a52ee9d
- https://github.com/django-haystack/django-haystack/releases/tag/v3.4.0
- https://api.github.com/repos/django-haystack/django-haystack/security-advisories/GHSA-r3hx-x5rh-p9vv