{"cve":"CVE-2019-14234","nvd":{"published":"2019-08-09T13:15:11.777","modified":"2026-06-17T02:18:00.427","status":"Modified","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-89"],"references":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","https://seclists.org/bugtraq/2019/Aug/15"],"products":["debian:debian_linux","djangoproject:django","fedoraproject:fedora"],"source":"nvd","synced_at":"2026-10-19T20:58:11.797917892+00:00"},"epss":{"cve":"CVE-2019-14234","score":0.47694,"percentile":0.98849,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6r97-cj55-9hrq","url":"https://osv.dev/vulnerability/GHSA-6r97-cj55-9hrq","summary":"SQL Injection in Django","modified":"2025-02-21T05:50:19.980781Z","packages":[{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=1.11a1 <1.11.23"],"fixed":["1.11.23"]},{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=2.1a1 <2.1.11"],"fixed":["2.1.11"]},{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=2.2a1 <2.2.4"],"fixed":["2.2.4"]}]},{"id":"PYSEC-2019-13","url":"https://osv.dev/vulnerability/PYSEC-2019-13","summary":"","modified":"2023-11-08T04:01:09.403667Z","packages":[{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=2.1 <2.1.11",">=1.11 <1.11.23",">=2.2 <2.2.4"],"fixed":["2.1.11","1.11.23","2.2.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}