CVE-2026-87890
5.3 MEDIUMpublic exploit availablePublished 2026-10-06 · Updated 2026-10-06
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-918
Public exploit & PoC references
- https://github.com/django/django/commit/4e77ef1e69c94780006b82795aa7db101996c3af
- https://github.com/django/django/commit/a2347fe8234a1831d56c875acc0ea51e0742957c
- https://github.com/django/django/commit/dd0558d1617619e0d66163675ef02135d0f54e5f
- https://github.com/django/django/commit/ebcb13b327301f28cbc6cd5e4988a719f00575aa
All references
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/4e77ef1e69c94780006b82795aa7db101996c3af
- https://github.com/django/django/commit/a2347fe8234a1831d56c875acc0ea51e0742957c
- https://github.com/django/django/commit/dd0558d1617619e0d66163675ef02135d0f54e5f
- https://github.com/django/django/commit/ebcb13b327301f28cbc6cd5e4988a719f00575aa
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/oct/06/security-releases/
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2020-37278PoC
- HIGHCVE-2023-54402PoC
- MEDIUMCVE-2024-34319
- UNSCOREDCVE-2026-0311
- LOWCVE-2026-100104
- MEDIUMCVE-2026-100251
- MEDIUMCVE-2026-100257
- MEDIUMCVE-2026-100279
Related by shared AI tags and CWE weakness class. Browse the full archive.