The Django development team has released versions 6.0.8 and 5.2.17 to address four security vulnerabilities affecting the widely used Python web framework. Developers and administrators are strongly advised to upgrade immediately, particularly if Django’s Geographic Information System (GIS) features or the built-in admin interface are accessible to staff users.
Details of the Security Vulnerabilities
The most critical issue, identified as CVE-2026-15307, involves spatial lookups processing raster-related values through GDALRaster. Previously, these lookups could accept string and dictionary inputs representing rasters. Depending on the raster driver used, a malicious input could lead to unauthorized file writes on the server or initiate network requests with the Django process’s permissions. In certain environments, this behavior could potentially result in remote code execution. This vulnerability is particularly concerning in Django admin changelists, where staff users with view permissions could filter on registered models containing spatial fields.
To mitigate this risk, Django now restricts dictionary values and non-GEOSGeometry strings from being used in spatial lookups. This change may impact applications that relied on these input types. However, model field assignments remain unaffected and can still accept such inputs. Developers handling untrusted spatial data should validate it before use and consult Django’s raster security guidance before implementing similar functionality in custom code.
Another vulnerability, CVE-2026-15337, presents a low-severity denial-of-service risk in the function django.utils.translation.check_for_language(). This function could store numerous distinct and excessively long language codes in an in-memory cache. An attacker could exploit this by sending lengthy values through POST requests to the optional set_language() view, gradually consuming server memory. While the memory impact was limited by Django’s request-size settings and a maximum cache-entry count, the update now rejects language codes exceeding 500 characters before they reach the cache, thereby reducing unnecessary memory usage.
CVE-2026-15830 addresses a denial-of-service flaw affecting applications utilizing geographic geometry processing. Deeply nested GEOMETRYCOLLECTION objects could cause a segmentation fault in the underlying GEOS library, potentially disrupting a Django application if crafted geometry input is passed to spatial field lookups or a GeometryField form field. The fix enforces a maximum of 198 nested geometry collections for well-known text input. For well-known binary input, Django limits the total number of geometry collections to 198. Developers requiring a different threshold can use the new max_geom_collections setting available in GEOSGeometry, as well as in relevant form fields and model fields. GeoJSON inputs remain unaffected as they are parsed by GDAL.
The fourth issue, CVE-2026-15920, is a moderate-severity stored cross-site scripting risk in Django admin views. URLField values were previously rendered as clickable links in changelists and read-only admin fields without verifying that the URL used a safe scheme. Consequently, a stored value with a dangerous scheme could appear as an active link. Django now validates URLField values with URLValidator before rendering them as links. Invalid values are displayed as plain text instead.
These fixes have also been applied to Django’s main branch and the Django 6.1 release candidate branch. Organizations should promptly update their Django deployments, test spatial lookup compatibility, and review admin access controls and input validation practices to maintain a secure environment.
Given the critical nature of these vulnerabilities, especially CVE-2026-15307, which could lead to remote code execution, it is imperative for organizations to prioritize these updates. Ensuring that Django applications are running the latest versions will help safeguard against potential exploits and maintain the integrity of web applications.
