CVE-2024-42005

score

<0.1

cvss

7.3

epss

1.5%

published

2024-08-07

kev added

—

first seen

2026-10-21

Django 5.0 before 5.0.8 and 4.2 before 4.2.15 contain a SQL injection caused by crafted JSON object keys in QuerySet.values() and values_list() methods on models with a JSONField, letting attackers execute arbitrary SQL commands, exploit requires passing malicious JSON keys as arguments.