CVE-2026-1287: Potential SQL injection in column aliases via control characters
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet methods annotate(), aggregate(), extra(), values(), valueslist(), and alias(). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Solomon Kebede for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.28 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.2.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 6.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1287?
CVE-2026-1287 has a critical severity due to its potential for SQL injection vulnerability.
How do I fix CVE-2026-1287?
You can fix CVE-2026-1287 by upgrading to Django version 6.0.2, 5.2.11, or 4.2.28.
What versions of Django are affected by CVE-2026-1287?
CVE-2026-1287 affects Django versions prior to 6.0.2, 5.2.11, and 4.2.28.
What kind of attack can CVE-2026-1287 facilitate?
CVE-2026-1287 can facilitate SQL injection attacks through improperly handled control characters in column aliases.
Is my application vulnerable to CVE-2026-1287?
If your application uses Django versions earlier than 6.0.2, 5.2.11, or 4.2.28, it is likely vulnerable to CVE-2026-1287.