CVE-2019-14234: Django JSONField and HStoreField SQL injection via key lookups

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCritical CVSS of 9.8 and very high EPSS, but exploitation requires an application code path that passes untrusted keys into these lookups, and no KEV listing or public exploit is recorded.

What it is

Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 mishandle shallow key transformation, leaving key and index lookups on django.contrib.postgres.fields.JSONField and key lookups on HStoreField open to SQL injection. An attacker who can influence the dictionary passed as **kwargs to QuerySet.filter() can inject SQL such as "OR 1=1" through a crafted key or index name. This matters because it breaks the query boundary Django normally enforces on ORM lookups.

Impact

An attacker can read or manipulate data beyond the intended query scope, for example returning all records instead of a filtered subset. The CVSS vector indicates high confidentiality, integrity and availability impact, so full compromise of the affected database-backed application is possible.

Attack surface

The flaw is reached over the network through application code that passes attacker-influenced keys or indexes into JSONField or HStoreField lookups on QuerySet.filter(). The CVSS vector shows no privileges and no user interaction required, but exploitation depends on the application exposing such a code path to untrusted input.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at roughly 0.477 probability over 30 days (98.8th percentile), and references are vendor advisories and distribution notices rather than public exploit write-ups.

What to do

• Upgrade Django to 1.11.23, 2.1.11, 2.2.4 or later, or apply the distribution backport for your package.
• Audit application code that builds JSONField or HStoreField lookups from user-supplied keys or indexes and validate or whitelist those values.
• Avoid passing untrusted dictionaries directly as **kwargs to QuerySet.filter(); construct lookups from a fixed allowlist.
• Update dependent packages on Fedora, Debian, openSUSE, Gentoo and NetApp products to the fixed versions noted in their advisories.
• Add regression tests that feed crafted key names into JSONField and HStoreField filters to confirm the fix holds.

Detection

• Review database query logs for JSONField or HStoreField lookups containing SQL metacharacters or boolean tautologies such as OR 1=1 in key or index positions.
• Monitor application logs for filter() calls with unexpected or attacker-shaped dictionary keys reaching PostgreSQL-backed endpoints.
• Check deployed Django versions against the fixed releases and flag any host still running 1.11.x below 1.11.23, 2.1.x below 2.1.11, or 2.2.x below 2.2.4.
• Alert on anomalous full-table result sets returned from endpoints that normally filter by JSON or HStore keys.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.