VDB
CVE-2026-87890
CVE-2026-87890
PUBLISHED
CVSS 5.3 MEDIUM
Reported by DSF · Published October 6, 2026
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| djangoproject | Django | 6.1, 6.1.2, 6.0 |
| alpine | py3-django | 0 |
| djangoproject | Django | 6.1, 6.1.2, 6.0 |
Timeline
- Oct 6, 2026 Coalition ESS Score
- Oct 6, 2026 CVE Published
- Oct 6, 2026 CVE Updated
- Oct 7, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 15, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
References
- Django security archive vendor-advisory
- Django releases announcements mailing-list
- patch
- patch
- patch
- patch
- Django security releases issued: 6.1.2, 6.0.9, and 5.2.18 vendor-advisory