CVE-2026-1207: Django SQL Injection Vulnerability in RasterField
Summary
CVE-2026-1207: Django has an SQL Injection issue. Affects django across 3 version ranges.
>= 4.2a1, < 4.2.28
>= 5.2a1, < 5.2.11
>= 6.0a1, < 6.0.2
Fixed in 4.2.28, 5.2.11 or 6.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2026-1207 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system, authentication, and a flexible URL routing system. The framework is widely used for its scalability and security features. However, certain versions of Django are vulnerable to SQL injection attacks, particularly in the RasterField implementation when using PostGIS.
Vulnerability Detail
An SQL Injection vulnerability exists in Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. This vulnerability arises from improper handling of the band index parameter in raster lookups on RasterField, allowing remote attackers to inject malicious SQL queries. The potential ramifications include unauthorized data access, data manipulation, and compromise of the database integrity. Unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected, although they have not been evaluated.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2a1, < 4.2.284.2.28pip install --upgrade "django==4.2.28" -
>= 5.2a1, < 5.2.115.2.11pip install --upgrade "django==5.2.11" -
>= 6.0a1, < 6.0.26.0.2pip install --upgrade "django==6.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization on the band index parameter to mitigate the risk of SQL injection. Ensure that only expected values are processed and reject any suspicious input.
Conclusion
The SQL Injection vulnerability in Django's RasterField implementation poses significant risks to applications using affected versions. It is crucial to update to the latest patched versions to safeguard against potential attacks. Additionally, implementing input validation can provide a temporary solution until an upgrade can be performed.
See every vulnerability recorded for django →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
If you cannot upgrade immediately, implement input validation and sanitization on the affected parameters to reduce the risk of SQL injection.
This vulnerability was reported by Tarek Nakkouch.
Related vulnerabilities
Recent vulnerabilities recorded for django.
