Threats tagged 'ghsa-pv4p-cwwg-4rph'

A critical SQL injection vulnerability exists in Django versions 5.0 prior to 5.0.8 and 4.2 prior to 4.2.15. The issue affects the QuerySet.values() and values_list() methods when used on models containing a JSONField. An attacker can exploit crafted JSON object keys passed as *args to inject malicious SQL via column aliases.