CVE-2024-53908: Django SQL Injection Vulnerability in JSON Field Lookup
Summary
CVE-2024-53908: An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Affects django across 3 version ranges.
>= 4.2, < 4.2.17
>= 5.0, < 5.0.10
>= 5.1, < 5.1.4
Fixed in 4.2.17, 5.0.10 or 5.1.4, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:12
The same CVE-2024-53908 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system, which allows developers to interact with databases using Python code instead of SQL. The framework supports various database backends, including Oracle. This vulnerability specifically affects versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17, where the direct usage of the django.db.models.fields.json.HasKey lookup can lead to SQL injection when untrusted data is used as a left-hand side (lhs) value.
Vulnerability Detail
An issue was discovered in Django where the direct usage of the django.db.models.fields.json.HasKey lookup, particularly when using an Oracle database, is vulnerable to SQL injection. This occurs if untrusted data is used as the lhs value. This vulnerability can allow an attacker to manipulate SQL queries, potentially leading to unauthorized access to sensitive data or other malicious actions. Applications that utilize the jsonfield.has_key lookup via double underscores (__) are not affected by this issue.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.174.2.17pip install --upgrade "django==4.2.17" -
>= 5.0, < 5.0.105.0.10pip install --upgrade "django==5.0.10" -
>= 5.1, < 5.1.45.1.4pip install --upgrade "django==5.1.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the django.db.models.fields.json.HasKey lookup directly with untrusted data as the lhs value. Instead, consider validating or sanitizing the input data before using it in queries.
Conclusion
In summary, CVE-2024-53908 is a critical SQL injection vulnerability affecting specific versions of Django when using the HasKey lookup with untrusted data in Oracle databases. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for django →
FAQ
CVE-2024-53908 is a vulnerability in Django that allows for SQL injection through the direct usage of the HasKey lookup with untrusted data in Oracle databases.
The affected versions are Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, ensure to validate or sanitize any untrusted data before using it in the HasKey lookup to mitigate the risk.
More information can be found in the official Django security advisory and the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for django.
