CVE-2021-35042: Djangoproject Django

Critical severity, CVSS 9.8. EPSS: 44.4% chance of exploitation in the next 30 days.

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Affected products

• Djangoproject Django: from 3.1, before 3.1.13 (fixed in 3.1.13); from 3.2, before 3.2.5 (fixed in 3.2.5)
• Fedoraproject Fedora: version 34 only

Published 2021-07-02. Last modified 2026-06-17.