CVE-2026-1287SQL Injection in Django

Severity
5.4MEDIUMNVD
GHSA7.5
EPSS
0.0%
top 98.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 3
Latest updateApr 15

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would li

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages3 packages

CVEListV5djangoproject/django6.06.0.2+2
NVDdjangoproject/django4.24.2.28+2
PyPIdjangoproject/django6.0a16.0.2+2

Patches

🔴Vulnerability Details

7
GHSA
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header2026-04-15
GHSA
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions2026-03-18
GHSA
Mattermost fails to properly validate User-Agent header tokens2026-03-16
GHSA
Django has an SQL Injection issue2026-02-03
OSV
CVE-2026-1287: An issue was discovered in 62026-02-03

📋Vendor Advisories

18
Red Hat
kernel: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP2026-04-13
Red Hat
jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure2026-04-13
Red Hat
mbedtls: Mbed TLS and TF-PSA-Crypto: Shared secret manipulation via improper FFDH input validation2026-04-01
Red Hat
kernel: ALSA: usb-audio: Use correct version for UAC3 header validation2026-03-25
Red Hat
Rails: Active Storage: Rails Active Storage: Content type bypass via arbitrary metadata in direct uploads2026-03-23

🕵️Threat Intelligence

1
Wiz
CVE-2026-1287 Impact, Exploitability, and Mitigation Steps | Wiz
CVE-2026-1287 — SQL Injection in Djangoproject Django | cvebase