CVE-2019-14234: SQL Injection in Django
Summary
CVE-2019-14234: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Affects django across 3 version ranges.
>= 1.11, < 1.11.23
>= 2.1, < 2.1.11
>= 2.2, < 2.2.4
Fixed in 1.11.23, 2.1.11 or 2.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2019-14234 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It includes various features and modules to facilitate database operations, such as the django.contrib.postgres.fields.JSONField and django.contrib.postgres.fields.HStoreField. These fields allow storing JSON and key-value pairs in PostgreSQL databases. However, versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 of Django are vulnerable to SQL injection due to an error in shallow key transformation.
Vulnerability Detail
The vulnerability in Django allows an attacker to perform SQL injection through key and index lookups in the JSONField and key lookups in the HStoreField. By crafting a malicious key or index name, an attacker can inject arbitrary SQL code, such as "OR 1=1", to manipulate the database query. This can lead to unauthorized access, data leakage, or even complete compromise of the application's database. The vulnerability can be exploited by passing a suitably crafted dictionary with dictionary expansion as the **kwargs parameter to the QuerySet.filter() function.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11, < 1.11.231.11.23pip install --upgrade "django==1.11.23" -
>= 2.1, < 2.1.112.1.11pip install --upgrade "django==2.1.11" -
>= 2.2, < 2.2.42.2.4pip install --upgrade "django==2.2.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to avoid using user-controlled input directly in key or index lookups for JSONField and key lookups for HStoreField. Instead, developers should sanitize and validate the input before using it in these operations. For example, using Django's built-in query parameterization or ORM methods can help prevent SQL injection.
Conclusion
The SQL injection vulnerability in Django versions 1.11.x, 2.1.x, and 2.2.x can be exploited through key and index lookups in JSONField and key lookups in HStoreField. Upgrading to the patched versions or applying input sanitization measures can mitigate the risk. For further assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 of Django are affected.
The vulnerability allows an attacker to perform SQL injection, potentially leading to unauthorized access, data leakage, or compromise of the application's database.
To fix this vulnerability, upgrade Django to version 1.11.23, 2.1.11, or 2.2.4.
A temporary workaround is to sanitize and validate user-controlled input before using it in key or index lookups for JSONField and key lookups for HStoreField.
You can find more information about this vulnerability in the official Django security advisory (PYSEC-2019-13).
Related vulnerabilities
Recent vulnerabilities recorded for django.
