The vulnerability CVE-2026-1287 in Django involves SQL injection via the FilteredRelation feature's handling of column aliases. Specifically, when dictionary expansion (**kwargs) is used in QuerySet methods like annotate(), aggregate(), extra(), values(), values_list(), and alias(), specially crafted input containing control characters can lead to SQL injection. This affects Django versions 6.0 prior to 6.0.2, 5.2 prior to 5.2.11, and 4.2 prior to 4.2.28. Earlier unsupported versions may also be affected but were not evaluated. Red Hat has published multiple advisories and errata providing patches and updates for affected products that include Django. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact without availability impact.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection attacks via crafted column aliases in Django QuerySet methods, potentially leading to unauthorized disclosure or modification of data. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Official patches are available for Django versions 6.0.2 and later, 5.2.11 and later, and 4.2.28 and later. Users should upgrade to these fixed versions to remediate the vulnerability. Red Hat has released security advisories and errata with updated packages addressing this issue. Users of affected Red Hat products should apply the relevant updates as per the vendor guidance. There is no indication that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by vendor advisories.