| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 4.2, < 4.2.24≥ 5.0a1, < 5.1.12≥ 5.1, < 5.1.12≥ 5.2, < 5.2.6≥ 5.2a1, < 5.2.6< 4.2.24 | 4.2.245.1.125.2.6 |
| django | ≥ 4.2, < 4.2.24≥ 5.1, < 5.1.12≥ 5.2, < 5.2.6 | 4.2.245.1.125.2.6 |
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free