{
  "cveId": "CVE-2026-1312",
  "url": "https://patchblox.com/security/cve/CVE-2026-1312",
  "summary": "CVE-2026-1312 is fixed in 3 products on 1 platform, first by python3-django 3:4.2.11-1ubuntu1.14, released February 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-django: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28",
  "description": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. \u0060.QuerySet.order_by()\u0060 is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in \u0060FilteredRelation\u0060. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.",
  "published": "2026-02-03T06:00:00Z",
  "severity": "medium",
  "cvss": 5.4,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.00897,
  "epssPercentile": 0.59799,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.2.11-150600.3.47.1",
      "fix": "SUSE-SU-2026:0440-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0440-1",
      "released": "2026-02-11T09:38:06Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.5.1",
      "fix": "OPENSUSE-SU-2026:20184-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20184-1",
      "released": "2026-02-07T13:45:17Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "sles 15.7",
      "fixedVersion": "4.2.11-150600.3.47.1",
      "fix": "SUSE-SU-2026:0440-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0440-1",
      "released": "2026-02-11T09:38:06Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3:3.2.25-0\u002Bdeb12u2",
      "fix": "DEBIAN-CVE-2026-1312",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-1312",
      "released": "2026-02-03T15:16:13Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3:4.2.28-0\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-1312",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-1312",
      "released": "2026-02-03T15:16:13Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:4.2.28-1",
      "fix": "DEBIAN-CVE-2026-1312",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-1312",
      "released": "2026-02-03T15:16:13Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3:4.2.11-1ubuntu1.14",
      "fix": "python3-django 3:4.2.11-1ubuntu1.14",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-django-3-4.2.11-1ubuntu1.14",
      "released": "2026-02-03T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3:5.2.4-1ubuntu2.3",
      "fix": "python3-django 3:5.2.4-1ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-django-3-5.2.4-1ubuntu2.3",
      "released": "2026-02-03T06:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}