CVE-2020-7471: Django SQL Injection Vulnerability
Summary
CVE-2020-7471: Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows w... Affects django across 4 version ranges.
>= 1.11, < 1.11.28
>= 2.2, < 2.2.10
>= 3.0, < 3.0.3
< eb31d845323618d688ad429479c6dda973056136
Fixed in 1.11.28, 2.2.10 or 3.0.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-7471 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a high-level API for handling web requests, managing databases, and rendering templates. Django is widely used and has a large community of developers contributing to its ecosystem. However, an SQL Injection vulnerability has been discovered in Django versions 1.11, 2.2, and 3.0.
Vulnerability Detail
The SQL Injection vulnerability in Django arises when untrusted data is used as a StringAgg delimiter. This vulnerability can be exploited in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a carefully crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, an attacker can bypass escaping mechanisms and inject malicious SQL code. This can lead to unauthorized access, data manipulation, or even complete compromise of the database.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11, < 1.11.281.11.28pip install --upgrade "django==1.11.28" -
>= 2.2, < 2.2.102.2.10pip install --upgrade "django==2.2.10" -
>= 3.0, < 3.0.33.0.3pip install --upgrade "django==3.0.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can sanitize and validate user input before using it as a delimiter in StringAgg instances. This involves ensuring that the delimiter does not contain any SQL special characters or sequences. Additionally, input validation and output encoding should be applied to prevent other types of injection attacks.
Conclusion
The SQL Injection vulnerability in Django can have serious consequences if left unaddressed. It is crucial for developers to upgrade their Django installations to the patched versions and follow secure coding practices to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies web application development by providing a high-level API for handling web requests, managing databases, and rendering templates.
Django versions 1.11, 2.2, and 3.0 are affected by this SQL Injection vulnerability.
SQL Injection is a type of security vulnerability where an attacker can insert malicious SQL code into a query, potentially gaining unauthorized access to the database or manipulating its contents.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, data manipulation, or even complete compromise of the database.
To protect your Django application, it is recommended to upgrade to the patched versions of Django (1.11.28, 2.2.10, or 3.0.3) and follow secure coding practices, such as input validation and output encoding.
Related vulnerabilities
Recent vulnerabilities recorded for django.
