Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py-djangoUpgrade py3-django | Aug 22, 2024 | Feb 3, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2020 |
| Debian | — | Upgrade python-django | Feb 20, 2020 | Feb 3, 2020 |
| Freebsd | — | Upgrade py27-django111Upgrade py38-django30Upgrade py37-django22Upgrade py38-django22Upgrade py36-django111Upgrade py37-django111Upgrade py36-django30Upgrade py35-django111Upgrade py35-django22Upgrade py36-django22Upgrade py38-django111Upgrade py37-django30 | Feb 5, 2020 | Feb 4, 2020 |
| Gentoo Linux | — | Upgrade dev-python/django. | May 1, 2020 | Feb 3, 2020 |
| Oracle Solaris | — | Upgrade library/python/django-37 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4 | Jan 19, 2021 | Feb 3, 2020 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Feb 5, 2020 | Feb 3, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub