Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
More of the CVEs fixed in Django: CVE-2026-1285: Potential DoS in django.utils.text.Truncator HTML methods CVE-2026-1287: Potential SQL injection in column aliases via control characters CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation
Post summary
The text is a brief disclosure of three Django CVEs that have been fixed, detailing DoS and SQL injection issues.
CVE-2026-1287 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control char… https://www.cve.org/CVERecord?id=CVE-2026-1287
Post summary
The text discloses a SQL injection vulnerability in FilteredRelation across several software versions, providing the technical nature of the flaw but no PoC, exploit code, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | djangoproject | django | - | - | - |