CVE-2026-1287 — Potential SQL injection in column aliases via control characters

Description (CNA)

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

Affected (CNA)

Vendor / product	Versions
djangoproject / Django	affected 6.0 before 6.0.2; unaffected 6.0.2; affected 5.2 before 5.2.11; unaffected 5.2.11; affected 4.2 before 4.2.28; unaffected 4.2.28

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to `QuerySet` methods like `annotate()` or `values()`, it can lead to the execution of arbitrary SQL commands. This could result in unauthorized access to sensitive data or modification of information within the database.