Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter

Summary

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

Timeline

1. Feb 3, 2020, 11:59 AM UTCCVE published
2. Aug 4, 2024, 9:33 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• djangoPyPI

  From 1.11 · fixed in 1.11.28; From 2.2 · fixed in 2.2.10; From 3.0 · fixed in 3.0.3

• djangoPyPI

  fixed in 1.11.28

• djangoPyPI

  From 2.0 · fixed in 2.2.10

• djangoPyPI

  From 3.0 · fixed in 3.0.3

References 19