Not rated
CVE-2026-1312 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28
Description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Django 6.0 | 6.0 → < 6.0.2 | 6.0.2 |
| Django 5.2 | 5.2 → < 5.2.11 | 5.2.11 |
| Django 4.2 | 4.2 → < 4.2.28 | 4.2.28 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.17 for RHEL 9 | Versions not published |
Show the 12 other branches Hide the 12 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Satellite 6.18 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 1772214630 | earliest → < 1772214630 | 1772214630 |
| Red Hat Ansible Automation Platform 2.6 1772552788 | earliest → < 1772552788 | 1772552788 |
| Red Hat Discovery 2 1770913597 | earliest → < 1770913597 | 1770913597 |
| Red Hat Satellite 6.18 1773451075 | earliest → < 1773451075 | 1773451075 |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Update Infrastructure 4 for Cloud Providers | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published |
References
- Django security archive docs.djangoproject.com
- Django releases announcements groups.google.com
- Django security releases issued: 6.0.2, 5.2.11, and 4.2.28 www.djangoproject.com
Timeline
- Published
- Last modified
Other CVEs of Django
The 62 CVEs of Django →
CVE-2026-114582
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19
5.3
Medium
CVE-2026-113733
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10
2.2
Low
CVE-2026-113593
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19
3.1
Low
CVE-2026-111362
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19
5.3
Medium