Cyber Security Published on February 3, 2026
CVE-2026-1207: SQL injection in Django GeoDjango/PostGIS raster lookups
Django patched a high-severity SQL injection vulnerability affecting raster lookups on RasterField, which is only implemented on PostGIS.
Remote attackers could inject arbitrary SQL via the band index parameter.
Patched versions are Django 6.0.2, 5.2.11, and 4.2.28. The issue was reported by Tarek Nakkouch.
Source: Django project