CVE-2026-1312Medium· 5.4▾ TwilightPoC available

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score42/ 100 · Moderate

impact 29.7 · likelihood 0.2 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Feb 3, 2026

Updated

Jun 30, 2026

CVSS

5.4

Vendor

djangoproject

Product

django

CWE

CWE-89

Depth score

42 · Moderate

EPSS

0.83% · p56

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

2 public repositories

EPSS history

Exploit-prediction probability, daily snapshots since Jul 3.

0.8% → 0.8%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 218 days

Feb 3, 2026Published
Disclosed via NVD
Jun 30, 2026Record revised
Last analysed / modified upstream
Jul 3, 2026EPSS first tracked
0.8%
Sep 2, 2026EPSS peak
0.8% → 0.8%
Sep 8, 2026Public exploit observed
2 GitHub repos

djangoproject CWE-89 #nvd #exploit-available #osv #pip

Affected

django >= 4.2, < 4.2.28
django >= 5.2, < 5.2.11
django >= 6.0, < 6.0.2

Patched in

django 6.0.2

Full technical detail▾

Overview

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.order_by() is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

Affected

django >= 4.2, < 4.2.28
django >= 5.2, < 5.2.11
django >= 6.0, < 6.0.2

Remediation

Upgrade past the affected range:

django 6.0.2

Package advisory (CVE-2026-1312)

Affected packages:

django >= 6.0a1, < 6.0.2
django >= 5.2a1, < 5.2.11
django >= 4.2a1, < 4.2.28

Patched in:

django 6.0.2
django 5.2.11
django 4.2.28

Source: https://osv.dev/vulnerability/GHSA-6426-9fv3-65x8

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#osv#pip