CVE-2026-105315 in django-haystack
Prediction
by VulDB Data Team • 10/05/2026
A vulnerability has been found in <a href="/product/django-haystack">django-haystack up to 3.3.0</a>. Affected is the function <code>_to_python</code> of the file <em>haystack/backends/elasticsearch_backend.py</em> of the component <em>more_like_this Template Tag Handler</em>. Such manipulation of the argument <em>result_class</em> leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is <em>eb05f193c9771a68dcc8cfac6674a0d48a52ee9d</em>. It is suggested to upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.