CVE-2026-105315: django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
django-haystackto a version that resolves this vulnerability.Fixed in 3.4.0Patch eb05f193c9771a68dcc8cfac6674a0d48a52ee9d
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Prioritize deployments using django-haystack versions up to and including 3.3.0, particularly where the more_like_this template tag handler is in use.
What level of attacker access is reflected in the severity assessment?
The CVSS vector lists privileges required as high, while the vulnerability report states that exploitation can be launched remotely. The issue involves manipulation of the result_class argument passed to dynamically evaluated code.
Is public exploitation a concern, and what is the recommended fix?
An exploit has been publicly disclosed and may be used. Upgrade django-haystack to version 3.4.0; the referenced patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d.