SQL Injection in Djangoproject Django
CVE-2026-1207
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
Vulnerability class: SQL Injection
EPSS: 0.130 (95.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Djangoproject Django — versions 6.0, 6.0.2, 5.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 (vendor-advisory, Patch, Vendor Advisory)
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 (mailing-list, Release Notes)
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 (vendor-advisory, Patch, Vendor Advisory)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-1207?
- CVE-2026-1207 is a medium-severity vulnerability in Djangoproject Django, classified under SQL Injection. CVSS score: 5.4/10. Published 2026-02-03.
- How severe is CVE-2026-1207?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2026-1207 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.