CVE-2026-1287: Django SQL Injection Vulnerability in Column Aliases
Summary
CVE-2026-1287: Potential SQL injection in column aliases via control characters. Affects django across 3 version ranges.
>= 4.2.0, < 4.2.28
>= 5.2.0, < 5.2.11
>= 6.0.0, < 6.0.2
Fixed in 4.2.28, 5.2.11 or 6.0.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-1287 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system that allows developers to interact with databases using Python code instead of SQL. However, certain versions of Django are vulnerable to SQL injection attacks through control characters in column aliases, which can lead to unauthorized data access or manipulation.
Vulnerability Detail
An issue was discovered in Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The vulnerability arises from the FilteredRelation feature, which is susceptible to SQL injection when using control characters in column aliases. This can occur when a malicious user crafts a dictionary with control characters and passes it as **kwargs to methods like annotate(), aggregate(), extra(), values(), values_list(), and alias(). The potential ramifications include unauthorized access to sensitive data or the ability to execute arbitrary SQL commands.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.284.2.28 -
>= 5.2.0, < 5.2.115.2.11 -
>= 6.0.0, < 6.0.26.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using control characters in column aliases when constructing queries with the affected methods. Additionally, consider validating and sanitizing input data before it is passed to these methods to mitigate the risk of SQL injection.
Conclusion
The CVE-2026-1287 vulnerability in Django poses a significant risk of SQL injection through control characters in column aliases. It is crucial for developers using affected versions to upgrade to the latest patched versions to ensure the security of their applications. Implementing workarounds and validating inputs can help mitigate risks until an upgrade is feasible.
See every vulnerability recorded for django →
FAQ
CVE-2026-1287 is a vulnerability in Django that allows for potential SQL injection through control characters in column aliases.
Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, implement input validation and avoid using control characters in column aliases as a temporary workaround.
The vulnerability was reported by Solomon Kebede, who identified the potential for SQL injection in the affected versions of Django.
Related vulnerabilities
Recent vulnerabilities recorded for django.
