Potential SQL injection via raster lookups on PostGIS (djangoproject Django)
At a glance
- Source
- NVD
- EPSS
- EPSS 12.82 % · percentile 96 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- DSF
- NVD status
- Modified
Description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
Weaknesses (CWE)
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
References
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
- https://access.redhat.com/security/cve/CVE-2026-1207
- https://bugzilla.redhat.com/show_bug.cgi?id=2436338
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1207.json
- https://access.redhat.com/errata/RHSA-2026:3959
- https://access.redhat.com/errata/RHSA-2026:5971
- https://access.redhat.com/errata/RHSA-2026:3958
- https://access.redhat.com/errata/RHSA-2026:5970
- https://access.redhat.com/errata/RHSA-2026:14835
- https://access.redhat.com/errata/RHSA-2026:3962
- https://access.redhat.com/errata/RHSA-2026:3960
- https://access.redhat.com/errata/RHSA-2026:2694
- https://access.redhat.com/errata/RHSA-2026:6291
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
| CVSS 3.1 | HIGH 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L | redhat-SADP |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 3.1 | HIGH 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Advisories
- GHSA-mwm9-4648-f68q — Django has an SQL Injection issue
- PYSEC-2026-44 — An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
European references
- ENISA EUVD · EUVD-2026-5253
- GCVE · GCVE-0-2026-1207
CERT-FR advisories
- CERTFR-2026-AVI-1056 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 4.2 < 4.2.28cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 5.2 < 5.2.11cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 6.0 < 6.0.2
Affected products
| Product | Versions |
|---|---|
| djangoproject · Django | affected 6.0 < 6.0.2 ; unaffected 6.0.2 ; affected 5.2 < 5.2.11 ; unaffected 5.2.11 ; affected 4.2 < 4.2.28 ; unaffected 4.2.28 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |