CVE-2026-1287: Django SQL Injection Vulnerability in FilteredRelation
Summary
CVE-2026-1287: Django has an SQL Injection issue. Affects django across 3 version ranges.
>= 4.2a1, < 4.2.28
>= 5.2a1, < 5.2.11
>= 6.0a1, < 6.0.2
Fixed in 4.2.28, 5.2.11 or 6.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2026-1287 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system that allows developers to interact with databases using Python code instead of SQL. However, certain versions of Django are vulnerable to SQL injection attacks, specifically through the use of the FilteredRelation feature, which can lead to unauthorized data access.
Vulnerability Detail
An SQL Injection vulnerability exists in Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. This vulnerability arises from the use of control characters in column aliases when using FilteredRelation with dictionary expansion in QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). Attackers can exploit this flaw to execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of the database.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2a1, < 4.2.284.2.28pip install --upgrade "django==4.2.28" -
>= 5.2a1, < 5.2.115.2.11pip install --upgrade "django==5.2.11" -
>= 6.0a1, < 6.0.26.0.2pip install --upgrade "django==6.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using FilteredRelation with dictionary expansion in the affected QuerySet methods until you can upgrade to a secure version of Django. This may involve refactoring your queries to eliminate the use of this feature.
Conclusion
The SQL Injection vulnerability in Django's FilteredRelation feature poses a significant risk to applications using affected versions. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for django →
FAQ
SQL Injection is a code injection technique that exploits a vulnerability in an application's software by allowing an attacker to interfere with the queries that an application makes to its database.
Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 are affected. Earlier unsupported versions may also be vulnerable.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without signup at Vulert Scanner.
If you cannot update Django right away, avoid using the FilteredRelation feature with dictionary expansion in your queries as a temporary workaround.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
