—

PYSEC-2021-10

Quick fix

PYSEC-2021-10 — django-debug-toolbar: upgrade to the fixed version with the command below.

pip install --upgrade 'django-debug-toolbar>=1.11.1'

Details

A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django-debug-toolbar

Introduced in: 0.10.0Fixed in: 1.11.1

Fixpip install --upgrade 'django-debug-toolbar>=1.11.1'

References

https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj[ADVISORY]
https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/[ARTICLE]
https://github.com/jazzband/django-debug-toolbar/releases[WEB]