CVE-2020-7471: SQL Injection in Django
Summary
CVE-2020-7471: SQL injection in Django. Affects django across 3 version ranges.
< 1.11.28
>= 2.0, < 2.2.10
>= 3.0, < 3.0.3
Fixed in 1.11.28, 2.2.10 or 3.0.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-7471 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It offers various features, including support for different databases and data manipulation operations. However, Django versions 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 are vulnerable to SQL Injection attacks.
Vulnerability Detail
The SQL Injection vulnerability in Django arises when untrusted data is used as a StringAgg delimiter. This vulnerability can be exploited in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a specially crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, an attacker can bypass escaping mechanisms and inject malicious SQL code. This can lead to unauthorized access, data manipulation, or even complete compromise of the underlying database.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.11.281.11.28pip install --upgrade "django==1.11.28" -
>= 2.0, < 2.2.102.2.10pip install --upgrade "django==2.2.10" -
>= 3.0, < 3.0.33.0.3pip install --upgrade "django==3.0.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to avoid using untrusted data as a StringAgg delimiter. Instead, consider using a predefined and trusted delimiter. Additionally, input validation and sanitization should be implemented to mitigate the risk of SQL Injection attacks.
Conclusion
In conclusion, the SQL Injection vulnerability in Django versions 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 can lead to unauthorized access and manipulation of data. It is recommended to upgrade to the fixed versions or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the process of building web applications. It provides a set of tools and libraries for handling various web development tasks.
SQL Injection is a type of vulnerability that allows an attacker to manipulate SQL queries executed by an application. By injecting malicious SQL code, an attacker can bypass security measures and gain unauthorized access to databases or manipulate data.
This vulnerability affects Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. If untrusted data is used as a delimiter, an attacker can exploit the vulnerability to inject malicious SQL code and potentially compromise the underlying database.
No, only Django versions 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 are affected by this SQL Injection vulnerability. It is recommended to upgrade to the fixed versions to mitigate the risk.
This vulnerability has a CVSS score of 9.8, indicating a critical severity level. It is crucial to address this vulnerability promptly to prevent potential exploitation and compromise of sensitive data.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
