CVE-2024-53908

A SQL injection vulnerability exists in Django versions prior to 5.1.4 , 5.0.10 , and 4.2.17 when using an Oracle database . The issue occurs during the direct usage of the django.db.models.fields.json.HasKey lookup with untrusted data as a left-hand side value. Applications using jsonfield.has_k...

CVE-2024-53908: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...