CVE-2026-105315

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105315
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-105315.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-105315
Aliases
Downstream
Published
2026-10-05T12:45:13Z
Modified
2026-10-06T02:47:24Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
Details

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-94",
        "CWE-95"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105315.json"
}
References

Affected packages

Git / github.com/django-haystack/django-haystack

Affected ranges

Type
GIT
Repo
https://github.com/django-haystack/django-haystack
Events
Introduced
1cc82885e287fe33bb937047137da3d803072684
Last Affected
76ec688d53e0e05f61c72fe088d35e53d6fdc1ff
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.0"
        },
        {
            "last_affected":  "3.0"
        },
        {
            "introduced":  "3.1"
        },
        {
            "last_affected":  "3.1"
        },
        {
            "introduced":  "3.2"
        },
        {
            "last_affected":  "3.2"
        },
        {
            "introduced":  "3.3.0"
        },
        {
            "last_affected":  "3.3.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

3.*
3.0
3.1
3.2
3.3.0
v3.*
v3.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.2.dev0
v3.3.0
v3.3b1
v3.3b2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-105315.json"