Django has an SQL Injection issue

TRUNG BÌNH 5.4CVE-2026-1207 · BIT-django-2026-1207 · GHSA-mwm9-4648-f68q · Công bố 03/02/2026 · cập nhật 15/07/2026

Tóm tắt nhanh

CVE-2026-1207 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng django, django (djangoproject).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 12.8%, cao hơn 96.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.2.28, 5.2.11, 6.0.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
django PyPI	`≥ 4.2, < 4.2.28≥ 4.2a1, < 4.2.28≥ 5.2, < 5.2.11≥ 5.2a1, < 5.2.11≥ 6.0, < 6.0.2≥ 6.0a1, < 6.0.2`	`4.2.285.2.116.0.2`
django djangoproject	`≥ 4.2, < 4.2.28≥ 5.2, < 5.2.11≥ 6.0, < 6.0.2`	`4.2.285.2.116.0.2`

Mô tả

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Tarek Nakkouch for reporting this issue.

Mô tả của NVD

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.