Active Exploitation of High-Severity Django SQL Injection Flaw Targets PostGIS-Backed Applications A critical SQL injection vulnerability (CVE-2026-1207) in Django’s GIS module is being actively exploited, posing significant risks to organizations using PostGIS-backed geospatial applications. Disclosed by the Django security team in February 2026 as part of a broader security release, the flaw stands out for its potential to enable direct database compromise. The vulnerability affects applications leveraging GeoDjango with the PostGIS backend, a common configuration for location-based services, mapping platforms, and data analytics systems. The issue stems from improper validation of the band index parameter in raster field lookups, allowing attackers to inject malicious SQL queries via crafted HTTP requests. Successful exploitation could lead to data exposure, unauthorized modifications, or bypassing application logic. Exploitation Details Threat intelligence sources, including CrowdSec, confirmed active attacks beginning in late February 2026. Unlike large-scale automated campaigns, these attacks appear targeted, focusing on high-value Django instances with PostGIS support. Attackers manipulate request parameters (e.g., the band parameter) to trigger unintended database queries, potentially leaking sensitive data or escalating access. Impact and Response The flaw’s severity is heightened by Django’s widespread use in enterprise and government applications. While exploitation requires a specific configuration, the potential impact including data breaches or backend tampering is substantial. The Django team released patched versions (6.0.2, 5.2.11, 4.2.28) addressing the SQL injection flaw alongside other vulnerabilities, such as denial-of-service and authentication weaknesses. Cybersecurity agencies, including the Canadian Center for Cyber Security, have issued advisories warning of active exploitation. Though not yet listed in major exploited vulnerability catalogs, the observed activity suggests growing adoption by threat actors. Organizations are advised to review logs for unusual query patterns, particularly those involving raster parameters or unexpected database errors, and prioritize patching to mitigate risk.