-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation of user-controlled input ('kind' in Trunc and 'lookup_name' in Extract) when constructing SQL queries. The commit 5e2f4ddf shows backend-specific datetime handling changes, but the core issue was in the ORM layer where these functions directly incorporated untrusted parameters into SQL without proper sanitization. The security patches added regex validation (extract_trunc_lookup_pattern) to these functions' as_sql methods to prevent injection, confirming these were the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 3.2a1, < 3.2.14 | 3.2.14 |
| Django | pip | >= 4.0a1, < 4.0.6 | 4.0.6 |
Ongoing coverage of React2Shell