CNNVD-202602-394 Information
CNNVD ID
CNNVD-202602-394
Related CVE
- CNNVD Published: 2026-02-03
Description (Chinese)
Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 6.0.2之前版本、5.2.11之前版本和4.2.28之前版本存在安全漏洞，该漏洞源于.QuerySet.order_by在包含句点的列别名中，当相同别名在FilteredRelation中使用特制字典时，可能导致SQL注入攻击。
Description (English)
Django is an open-source Web application framework based on the Python language of the Django Foundation. The framework includes object-oriented maprs, view systems, templates, etc. There is a security loophole in the pre-Django 6.2, pre-5.2.11 and pre-4.2.28 versions, which originates from … QuerySet.order by ’ s inclusion of a stop aliases, which could lead to an SQL injection attack when the same aliases are used in the FilteredRelation.
Hazard Level
Medium
Vulnerability Type
其他
Affected Vendor
Django
Published
2026-02-03
Last Modified
2026-02-24
References
https://docs.djangoproject.com/en/dev/releases/security/ https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/feb/03/security-releases/ https://access.redhat.com/security/cve/cve-2026-1312
Patch
https://docs.djangoproject.com/en/dev/releases/security/
Share on: