CVE-2024-53908Critical· 9.8▾ Midnight

Django SQL injection in HasKey(lhs, rhs) on Oracle

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 53.9 · likelihood 0.3 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 6, 2024

Updated

Sep 10, 2026

CVSS

9.8

Vendor

django

Product

django

CWE

—

Depth score

54 · Moderate

EPSS

1.4% · p72

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

1.4% → 1.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 645 days

Dec 6, 2024Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
1.4%

django #osv #pip

Affected

django >= 5.0.0, < 5.0.10
django >= 5.1.0, < 5.1.4
django >= 4.2.0, < 4.2.17
django >= 5.1, < 5.1.4
django >= 5.0, < 5.0.10
django >= 4.2, < 4.2.17

Patched in

django 5.0.10
django 5.1.4
django 4.2.17
django 5.1.4
django 5.0.10
django 4.2.17

Full technical detail▾

Overview

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

Affected packages

django >= 5.0.0, < 5.0.10
django >= 5.1.0, < 5.1.4
django >= 4.2.0, < 4.2.17
django >= 5.1, < 5.1.4
django >= 5.0, < 5.0.10
django >= 4.2, < 4.2.17

Remediation

Upgrade to a patched release:

django 5.0.10
django 5.1.4
django 4.2.17
django 5.1.4
django 5.0.10
django 4.2.17

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip

← Back to feed

CVE-2024-53908Critical· 9.8▾ Midnight

Django SQL injection in HasKey(lhs, rhs) on Oracle

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 53.9 · likelihood 0.3 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 6, 2024

Updated

Sep 10, 2026

CVSS

9.8

Vendor

django

Product

django

CWE

—

Depth score

54 · Moderate

EPSS

1.4% · p72

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

1.4% → 1.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 645 days

Dec 6, 2024Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
1.4%

django #osv #pip

Affected

django >= 5.0.0, < 5.0.10
django >= 5.1.0, < 5.1.4
django >= 4.2.0, < 4.2.17
django >= 5.1, < 5.1.4
django >= 5.0, < 5.0.10
django >= 4.2, < 4.2.17

Patched in

django 5.0.10
django 5.1.4
django 4.2.17
django 5.1.4
django 5.0.10
django 4.2.17

Full technical detail▾

Overview

Affected packages

django >= 5.0.0, < 5.0.10
django >= 5.1.0, < 5.1.4
django >= 4.2.0, < 4.2.17
django >= 5.1, < 5.1.4
django >= 5.0, < 5.0.10
django >= 4.2, < 4.2.17

Remediation

Upgrade to a patched release:

django 5.0.10
django 5.1.4
django 4.2.17
django 5.1.4
django 5.0.10
django 4.2.17

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip