CVE-2026-105315

A flaw was found in django-haystack. This flaw allows a remote attacker to achieve arbitrary code execution on the hosting server by supplying crafted data to the search index. Due to improper input handling, the Elasticsearch backend unsafely evaluates raw search result values as executable code...

Linux Distros Unpatched Vulnerability : CVE-2026-105315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the...

DEBIAN-CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

UBUNTU-CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability exists in django-haystack versions up to 3.3.0 within the more_like_this Template Tag Handler. Specifically, the _to_python function in haystack/backends/elasticsearch_backend.py is susceptible to eval injection (CWE-95, CWE-94) because manipulation of the result_class argument le...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

aleksis (>=2022.6.0.post0, <=2023.1.0.dev0), aleksis-app-alsijil (>=2.0.0, <=2.1.1) +57 more potentially affected by CVE-2026-105315 via django-haystack (>=3.0.0, <=3.3.0)

django-haystack PYPI version =3.0.0, =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.1.1, =2.0.0b0, =1.0.0, =1.0.2 and more Source cves: CVE-2026-105315 Source advisory: MEND:CVE-2026-105315...

EUVD-2026-92429

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315: Improper Neutralization of Directives in Dynamically Evaluated Code

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

PT-2026-105984

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function to python of the file haystack/backends/elasticsearch backend.py of the component more like this Template Tag Handler. Such manipulation of the argument result class leads to improper neutralization of...

Security update for python-django-haystack (important)

openSUSE Security Update: Security update for python-django-haystack Announcement ID: openSUSE-SU-2026:0252-1 Rating: important References: 1271593 Affected Products: openSUSE Backports SLE-15-SP7 An update that contains security fixes can now be installed. Description: This update for...

GHSA-R3HX-X5RH-P9VV django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

Remote Code Execution via eval in Elasticsearch Result Deserialization Summary The Elasticsearch backend in django-haystack calls eval on raw field values returned from Elasticsearch when a SearchField is declared with an indexfieldname alias that differs from the logical field name. During resul...

aleksis (>=2022.6.0.post0, <=2023.1.0.dev0), aleksis-app-alsijil (>=2.0.0, <=2.1.1) +72 more potentially affected by unknown CVE via django-haystack (>=2.3.2, <=3.3.0)

django-haystack PYPI version =2.3.2, =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.1.1, =2.0.0b0, =1.0.0, =1.0.2 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-DJANGOHAYSTACK-18016323...

aleksis (>=2022.6.0.post0, <=2023.1.0.dev0), aleksis-app-alsijil (>=2.0.0, <=2.1.1) +57 more potentially affected by unknown CVE via django-haystack (>=3.0.0b1, <=3.3.0)

django-haystack PYPI version =3.0.0b1, =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.1.1, =2.0.0b0, =1.0.0, =1.0.2 and more Source cves: unknown CVE Source advisory: GHSA-R3HX-X5RH-P9VV...