Django ships four CVEs, JSONField fixes land

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Security releases cover formset action forging, spatial lookup bytes, and WKB geometry limits; JSONField value handling gets patched across backends.

50 commits 37 PRs merged 7 briefings covered

all django reviews →

← previous week django wire → next week →

Fixed CVE-2026-87975 -- Prevented forging actions in model formsets with editable PKs. django/django

by Jacob Walls

Forged POST data for an editable primary key let an attacker delete objects outside a ModelFormSet's queryset, and create objects on edit-only formsets. Anyone running model formsets with editable PKs exposed to untrusted input needs the patched release, not a workaround.

Refs CVE-2026-15830 -- Fixed WKB geometry collection limit bypasses. django/django

by Jacob Walls

Invalid byte-order markers and recursively nested multi-geometries such as a MULTIPOINT inside a MULTIPOINT slipped past the WKB geometry collection limiter, which GEOS tolerates. The fix closes parsing paths that let an oversized or malformed payload through.

Fixed CVE-2026-87890 -- Blocked bytes in spatial lookups. django/django

by Sarah Boyce

Raster values supplied as bytes still triggered network fetches when resolving references, despite going through the in-memory virtual filesystem. The release notes credit sicksec for the report, with fixes from Jacob Walls, Jake Howard, and David Smith.

Fixed #37377 -- Fixed JSONField __in crash/wrong result for Value() primitives. django/django

by Clifford Gama

A prior change wrapped every Value() right-hand side of JSONIn in JSON_EXTRACT()/JSON_VALUE(), which only holds for Value(..., JSONField()); bare Value("primitive") produced crashes or wrong results. If you filter JSONField __in with plain Python values, upgrade before trusting the query.

Fixed #37403 -- Fixed JSONField __in crash on SQLite with Value(None) expressions. django/django

by Clifford Gama

A follow-up to the same regression: Value(None) expressions crashed JSONField __in on SQLite. SQLite users hitting that combination get the fix here.

Fixed #37322 -- Avoided transforms on spatial fields with srid=None. django/django

by Yassin Bahri

After spatial queries stopped interpolating the SRID into the SQL template, srid=None became valid input to ST_Transform() on PostGIS and SpatiaLite and quietly returned NULL. The code now avoids transforms on those fields instead of returning empty results.

Fixed #37297 -- Prevented crash on JSONField key lookups when an integer key is outside PostgreSQL's int4 range. django/django

by Clifford Gama

Integer JSON keys past PostgreSQL's int4 range crashed key lookups. Django 11 handles the out-of-range literal rather than raising, and an accompanying fix covers Oracle's JSON_EXISTS() rejecting long array-subscript literals with ORA-40598/JZN-00211.

Added a 24 hour grace period for automated PR quality checks. django/django

by sarahboyce

Automated PR quality checks now post a comment explaining failures and wait 24 hours before closing, after DjangoCon sprint feedback that the auto-close was too aggressive for contributors who simply forgot a checkbox.

$ ls django/week/ # the briefings behind this review

Mon Oct 5 django-asv adds ubuntu-latest benchmark results Tue Oct 6 Spatial SRID validation, JSONField __in fixes land in Django Wed Oct 7 Django ships five security fixes, including formsets and spatial lookups Thu Oct 8 JSONField integer keys stop crashing Postgres and Oracle Fri Oct 9 Django softens PR auto-close, fixes JSONField __in crash on SQLite Sat Oct 10 Dynamic {% now %} formatting, async support in @non_atomic_requests Sun Oct 11 asgiref drops Python 3.10 and its custom timeout, Django patches oracledb 26

all django reviews →

← previous week django wire → next week →