An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. (CVE-2026-87890)

CVE-2026-87890 is a vulnerability in Django spatial lookups where an incomplete fix for CVE-2026-15307 allows an attacker capable of supplying bytes input to trigger the Django process to make network requests via a crafted VRT document that references an external raster source. This affects Django versions prior to 6.1.2, 6.0.9, and 5.2.18. The vulnerability relates to improper handling of spatial lookup data, potentially causing unintended external network interactions. Unsupported earlier versions such as 5.1.x, 5.0.x, and 4.2.x were not assessed for this issue.

The vulnerability allows an unauthenticated attacker to cause the Django process to make network requests to external resources by supplying crafted input. The CVSS score of 5.3 (medium severity) reflects a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to information disclosure (confidentiality loss) due to unintended network requests. There is no impact on integrity or availability.

A fix is available in Django versions 6.1.2, 6.0.9, and 5.2.18. Users should upgrade to these or later versions to remediate the vulnerability. Earlier unsupported versions were not evaluated; users on those versions should consider upgrading to a supported and patched release. No vendor advisory content was provided to indicate otherwise.