CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

Remote Code Execution via eval() in Elasticsearch Result Deserialization

Summary

The Elasticsearch backend in django-haystack calls eval() on raw field values returned from Elasticsearch when a SearchField is declared with an index_fieldname alias that differs from the logical field name. During result processing, the backend looks up fields by logical name but Elasticsearch stores them under the alias key; the lookup fails and the value falls through to _to_python() → eval(). An attacker who can control content that is indexed into Elasticsearch—and can trigger or wait for a search that returns it—achieves arbitrary code execution in the Django application process. CVSS 3.1 Base Score: 8.5 (High).

Details

Sink — haystack/backends/elasticsearch_backend.py:865:

converted_value = eval(value)

_to_python() (line ~850) attempts to parse a string value by calling eval() before performing any type-safety check. If the value is an attacker-controlled Python expression such as __import__('os').system(...), the expression is executed unconditionally.

Root cause — haystack/backends/elasticsearch_backend.py:727–737:

for key, value in source.items():
    string_key = str(key)

    if string_key in index.fields and hasattr(index.fields[string_key], "convert"):
        additional_fields[string_key] = index.fields[string_key].convert(value)
    else:
        additional_fields[string_key] = self._to_python(value)

index.fields is keyed by the logical field name (e.g. "name"), but Elasticsearch stores the document under the index_fieldname alias (e.g. "name_s"). Because "name_s" not in index.fields, the branch falls through to self._to_python(value).

Data flow (source → sink):

1. haystack/indexes.py:226 — self.prepared_data[field.index_fieldname] = field.prepare(obj) stores data under the alias.
2. haystack/backends/elasticsearch_backend.py:218 — prepared data copied into final_data.
3. haystack/backends/elasticsearch_backend.py:236 — bulk(...) writes the document to Elasticsearch under the alias key.
4. haystack/backends/elasticsearch_backend.py:574 — search reads attacker-influenced _source back from Elasticsearch.
5. haystack/backends/elasticsearch_backend.py:720 — _process_results() takes raw_result["_source"].
6. haystack/backends/elasticsearch_backend.py:730 — lookup string_key in index.fields fails for alias keys.
7. haystack/backends/elasticsearch_backend.py:737 — unmatched value passed to _to_python(value).
8. haystack/backends/elasticsearch_backend.py:865 — sink: converted_value = eval(value).

Missing fix: The Solr backend correctly remaps aliases at haystack/backends/solr_backend.py:535–539 using index.field_map before performing the index.fields lookup. The Elasticsearch backend has no equivalent remapping.

Preconditions:

• The application uses the Elasticsearch backend.
• At least one SearchField in a SearchIndex is declared with index_fieldname set to a value different from the logical attribute name.
• The attacker can write content that is indexed (e.g. via a form, API, or any user-controlled field included in the index).
• The attacker can trigger or wait for a search that returns the malicious document.

PoC

Environment setup (Docker):

# Build the proof-of-concept image
docker build -t vuln001-poc \
  -f /path/to/vuln-001/Dockerfile \
  /path/to/reports/pypiAi_436_django-haystack__django-haystack/

# Run the PoC — exits 0 on confirmed RCE
docker run --rm vuln001-poc

Dockerfile (vuln-001/Dockerfile):

FROM python:3.11-slim
WORKDIR /app
RUN pip install --no-cache-dir setuptools setuptools_scm wheel
COPY repo/ /app/repo/
RUN pip install --no-cache-dir "Django>=4.2" "elasticsearch>=5,<8"
RUN SETUPTOOLS_SCM_PRETEND_VERSION=0.0.dev0 pip install --no-cache-dir -e /app/repo/
COPY vuln-001/poc.py…

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

Remote Code Execution via eval() in Elasticsearch Result Deserialization

Summary

The Elasticsearch backend in django-haystack calls eval() on raw field values returned from Elasticsearch when a SearchField is declared with an index_fieldname alias that differs from the logical field name. During result processing, the backend looks up fields by logical name but Elasticsearch stores them under the alias key; the lookup fails and the value falls through to _to_python() → eval(). An attacker who can control content that is indexed into Elasticsearch—and can trigger or wait for a search that returns it—achieves arbitrary code execution in the Django application process. CVSS 3.1 Base Score: 8.5 (High).

Details

Sink — haystack/backends/elasticsearch_backend.py:865:

converted_value = eval(value)

_to_python() (line ~850) attempts to parse a string value by calling eval() before performing any type-safety check. If the value is an attacker-controlled Python expression such as __import__('os').system(...), the expression is executed unconditionally.

Root cause — haystack/backends/elasticsearch_backend.py:727–737:

for key, value in source.items():
    string_key = str(key)

    if string_key in index.fields and hasattr(index.fields[string_key], "convert"):
        additional_fields[string_key] = index.fields[string_key].convert(value)
    else:
        additional_fields[string_key] = self._to_python(value)

index.fields is keyed by the logical field name (e.g. "name"), but Elasticsearch stores the document under the index_fieldname alias (e.g. "name_s"). Because "name_s" not in index.fields, the branch falls through to self._to_python(value).

Data flow (source → sink):

1. haystack/indexes.py:226 — self.prepared_data[field.index_fieldname] = field.prepare(obj) stores data under the alias.
2. haystack/backends/elasticsearch_backend.py:218 — prepared data copied into final_data.
3. haystack/backends/elasticsearch_backend.py:236 — bulk(...) writes the document to Elasticsearch under the alias key.
4. haystack/backends/elasticsearch_backend.py:574 — search reads attacker-influenced _source back from Elasticsearch.
5. haystack/backends/elasticsearch_backend.py:720 — _process_results() takes raw_result["_source"].
6. haystack/backends/elasticsearch_backend.py:730 — lookup string_key in index.fields fails for alias keys.
7. haystack/backends/elasticsearch_backend.py:737 — unmatched value passed to _to_python(value).
8. haystack/backends/elasticsearch_backend.py:865 — sink: converted_value = eval(value).

Missing fix: The Solr backend correctly remaps aliases at haystack/backends/solr_backend.py:535–539 using index.field_map before performing the index.fields lookup. The Elasticsearch backend has no equivalent remapping.

Preconditions:

• The application uses the Elasticsearch backend.
• At least one SearchField in a SearchIndex is declared with index_fieldname set to a value different from the logical attribute name.
• The attacker can write content that is indexed (e.g. via a form, API, or any user-controlled field included in the index).
• The attacker can trigger or wait for a search that returns the malicious document.

PoC

Environment setup (Docker):

# Build the proof-of-concept image
docker build -t vuln001-poc \
  -f /path/to/vuln-001/Dockerfile \
  /path/to/reports/pypiAi_436_django-haystack__django-haystack/

# Run the PoC — exits 0 on confirmed RCE
docker run --rm vuln001-poc

Dockerfile (vuln-001/Dockerfile):

FROM python:3.11-slim
WORKDIR /app
RUN pip install --no-cache-dir setuptools setuptools_scm wheel
COPY repo/ /app/repo/
RUN pip install --no-cache-dir "Django>=4.2" "elasticsearch>=5,<8"
RUN SETUPTOOLS_SCM_PRETEND_VERSION=0.0.dev0 pip install --no-cache-dir -e /app/repo/
COPY vuln-001/poc.py…

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.