CVE-2021-35042: Django SQL Injection in QuerySet.order_by
Summary
CVE-2021-35042: Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application. Affects django across 2 version ranges.
>= 3.1, < 3.1.13
>= 3.2, < 3.2.5
Fixed in 3.1.13 or 3.2.5, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2021-35042 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It offers features such as an ORM (Object-Relational Mapping) system, template engine, and routing mechanism. The QuerySet.order_by method in Django allows developers to specify the ordering of query results based on one or more fields. However, versions 3.1.x before 3.1.13 and 3.2.x before 3.2.5 are vulnerable to SQL injection when untrusted input is used for the order_by parameter. This means that an attacker can manipulate the ordering of query results and potentially execute arbitrary SQL statements.
Vulnerability Detail
The vulnerability in Django arises from the lack of proper input validation and sanitization when processing the order_by parameter in QuerySet.order_by. If an application allows untrusted input from a client to be directly used in the order_by parameter without proper validation or sanitization, an attacker can craft a malicious input that includes SQL statements. When the query is executed, these SQL statements will be executed as well, leading to SQL injection. The impact of this vulnerability can range from unauthorized data access to full control of the database server, depending on the attacker's intentions and the underlying database permissions.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.133.1.13pip install --upgrade "django==3.1.13" -
>= 3.2, < 3.2.53.2.5pip install --upgrade "django==3.2.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the order_by parameter before using it in the QuerySet.order_by method. This can be done by implementing custom input validation and sanitization logic, such as using regular expressions or predefined whitelists of allowed values. It is important to thoroughly test the workaround to ensure that it effectively mitigates the SQL injection vulnerability.
Conclusion
Django versions 3.1.x before 3.1.13 and 3.2.x before 3.2.5 are vulnerable to SQL injection in the QuerySet.order_by method. This vulnerability can be exploited by an attacker to execute arbitrary SQL statements and potentially gain unauthorized access to data or control over the database server. It is crucial to upgrade Django to the recommended versions or implement the provided workaround to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the development of web applications by providing a set of tools and libraries for common web development tasks.
SQL injection is a type of security vulnerability that allows an attacker to manipulate SQL queries executed by an application. By injecting malicious SQL statements, an attacker can bypass security measures and potentially gain unauthorized access to data or execute arbitrary commands on the database server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock file to identify vulnerable dependencies and provides real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to promptly apply the recommended fixes to prevent potential attacks.
While upgrading Django to the patched versions is the recommended solution, you can implement a temporary workaround by manually validating and sanitizing the order_by parameter before using it in the QuerySet.order_by method. However, this workaround should be considered temporary, and upgrading Django is strongly advised.
Related vulnerabilities
Recent vulnerabilities recorded for django.
