CVE-2026-1207: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in djangoproject Django
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-1207) involves improper neutralization of special elements used in an SQL command (CWE-89) within Django's RasterField lookups on PostGIS databases. Specifically, the band index parameter can be manipulated by remote attackers to perform SQL injection attacks. The flaw affects Django versions 4.2 prior to 4.2.28, 5.2 prior to 5.2.11, and 6.0 prior to 6.0.2. Red Hat advisories provide patches and updates for affected products, indicating that fixes are available.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands via the band index parameter in RasterField lookups, potentially leading to unauthorized data access or modification. The CVSS score is 5.4 (medium), reflecting limited confidentiality and integrity impact without availability impact. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Official fixes are available for this vulnerability. Users should upgrade Django to versions 4.2.28 or later, 5.2.11 or later, or 6.0.2 or later to remediate the issue. Red Hat has issued security advisories and errata with updated packages addressing this vulnerability. Applying these vendor-provided patches is the recommended mitigation. Patch status is confirmed by vendor advisories linked in the references.
CVE-2026-1207: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in djangoproject Django
Description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
CVSS v3.1
Score 5.4medium
Affected software
djangoproject
Django
pkg:pypi/djangoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-1207) involves improper neutralization of special elements used in an SQL command (CWE-89) within Django's RasterField lookups on PostGIS databases. Specifically, the band index parameter can be manipulated by remote attackers to perform SQL injection attacks. The flaw affects Django versions 4.2 prior to 4.2.28, 5.2 prior to 5.2.11, and 6.0 prior to 6.0.2. Red Hat advisories provide patches and updates for affected products, indicating that fixes are available.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands via the band index parameter in RasterField lookups, potentially leading to unauthorized data access or modification. The CVSS score is 5.4 (medium), reflecting limited confidentiality and integrity impact without availability impact. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Official fixes are available for this vulnerability. Users should upgrade Django to versions 4.2.28 or later, 5.2.11 or later, or 6.0.2 or later to remediate the issue. Red Hat has issued security advisories and errata with updated packages addressing this vulnerability. Applying these vendor-provided patches is the recommended mitigation. Patch status is confirmed by vendor advisories linked in the references.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- DSF
- Date Reserved
- 2026-01-19T20:14:06.262Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-1207","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:3959","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:5971","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:3958","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:5970","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:14835","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:3962","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:3960","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:2694","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6291","vendor":"Red Hat"}]
Threat ID: 69820d79f9fa50a62fcd6040
Added to database: 02/03/2026, 15:00:09 UTC
Last enriched: 07/15/2026, 08:28:14 UTC
Last updated: 09/10/2026, 22:15:34 UTC
Views: 592
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.