09-13-2025, 12:30 PM
High
resolved
resolved
SQL injection in JSONField KeyTransform
Bug reported by Eyal Gabay was disclosed at September 12, 2025, 12:28 am | SQL Injection
A vulnerability was discovered in the JSONField KeyTransform functionality of Django. The vulnerability allowed SQL injection attacks by crafting malicious user input for the .values() method. The vulnerability was demonstrated in the Django test suite, where a SQL syntax error was triggered by inputting a specifically crafted string.