CVE-2026-1312: Djangoproject Django SQLi Vulnerability

CVE-2026-1312 Overview

CVE-2026-1312 is a SQL Injection vulnerability affecting Django, the popular Python web framework. The vulnerability exists in the .QuerySet.order_by() method when column aliases containing periods are used in conjunction with FilteredRelation through dictionary expansion. An authenticated attacker can craft a malicious dictionary that, when expanded and used with FilteredRelation, allows arbitrary SQL injection through the column alias parameter.

Critical Impact

Authenticated attackers can exploit this SQL injection vulnerability to read or modify sensitive database contents, potentially leading to data exfiltration or unauthorized data manipulation in Django applications.

Affected Products

• Django 6.0 before 6.0.2
• Django 5.2 before 5.2.11
• Django 4.2 before 4.2.28

Discovery Timeline

• 2026-02-03 - Django releases security patches for CVE-2026-1312
• 2026-02-03 - CVE CVE-2026-1312 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-1312

Vulnerability Analysis

This vulnerability represents a SQL injection flaw in Django's ORM layer, specifically within the QuerySet.order_by() method. The issue arises when column aliases containing period characters are processed in combination with FilteredRelation. When an attacker provides a specially crafted dictionary and uses dictionary expansion (the ** operator in Python), the unsanitized alias can be passed into the SQL query construction process, bypassing Django's typical SQL injection protections.

The vulnerability requires the attacker to have some level of authenticated access to influence query parameters that are subsequently used in order_by() operations with FilteredRelation. This is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Django acknowledged Solomon Kebede for reporting this vulnerability. Earlier, unsupported Django series including 5.0.x, 4.1.x, and 3.2.x were not evaluated and may also be affected.

Root Cause

The root cause stems from insufficient input validation in the order_by() method when handling column aliases that contain period characters. In Django's ORM, periods in field names typically denote relationship traversals (e.g., related_model.field). However, when combined with FilteredRelation and dictionary expansion, the alias parsing logic fails to properly sanitize or validate the input, allowing SQL syntax to be injected through the alias value.

Attack Vector

The attack is network-based and requires low privileges (authenticated access). An attacker must be able to influence the parameters passed to order_by() in a context where FilteredRelation is used with dictionary expansion. This could occur in applications that:

1. Accept user-controlled sorting parameters
2. Use FilteredRelation to optimize related model queries
3. Apply dictionary expansion to build dynamic query parameters

The vulnerability allows attackers to inject arbitrary SQL into ORDER BY clauses, which can be leveraged to extract database information or modify query behavior. While direct data modification through ORDER BY injection is limited, techniques like error-based or time-based SQL injection can be used to exfiltrate sensitive data.

Detection Methods for CVE-2026-1312

Indicators of Compromise

• Unusual SQL errors in application logs, particularly those referencing ORDER BY clauses or syntax errors with period characters
• Web application firewall (WAF) alerts for SQL injection patterns in sorting parameters
• Database query logs showing malformed or suspicious ORDER BY clauses with unexpected SQL fragments
• Increased failed query attempts or database errors from authenticated user sessions

Detection Strategies

• Monitor application logs for SQL syntax errors that may indicate injection attempts
• Implement WAF rules to detect SQL injection patterns in query string and POST parameters related to sorting functionality
• Review Django QuerySet usage patterns in code for dynamic order_by() calls combined with FilteredRelation and user-controlled input
• Deploy runtime application self-protection (RASP) solutions to detect anomalous SQL query construction

Monitoring Recommendations

• Enable detailed Django database query logging to capture all executed SQL statements
• Configure alerting for unusual patterns in ORDER BY clause construction
• Monitor for authentication anomalies combined with database query spikes that may indicate exploitation attempts
• Implement database activity monitoring to detect potential data exfiltration patterns

How to Mitigate CVE-2026-1312

Immediate Actions Required

• Upgrade Django to patched versions: 6.0.2, 5.2.11, or 4.2.28 depending on your series
• Audit application code for usage of order_by() with FilteredRelation and dictionary expansion
• Validate and whitelist acceptable column names before passing to order_by()
• Review and restrict user input that influences query ordering parameters

Patch Information

Django has released security updates addressing this vulnerability. Administrators should upgrade to the following versions:

• Django 6.0 series: Upgrade to 6.0.2 or later
• Django 5.2 series: Upgrade to 5.2.11 or later
• Django 4.2 series: Upgrade to 4.2.28 or later

For detailed patch information, refer to the Django February 2026 Security Releases announcement. Additional security documentation is available in the Django Security Release Notes.

Workarounds

• Implement strict allowlisting for any user-controlled ordering parameters, rejecting any values containing periods or special characters
• Avoid using dictionary expansion with user-controlled data in conjunction with FilteredRelation
• Add application-level input validation to sanitize sorting parameters before they reach Django's ORM
• Consider temporarily disabling dynamic sorting features until patches can be applied

# Upgrade Django to patched version
pip install --upgrade Django>=6.0.2

# For Django 5.2 series
pip install --upgrade 'Django>=5.2.11,<6.0'

# For Django 4.2 LTS series
pip install --upgrade 'Django>=4.2.28,<5.0'

# Verify installed version
python -c "import django; print(django.VERSION)"