{"id":"CVE-2021-30459","aliases":["EUVD-2021-0052","GHSA-pghf-347x-c2gj","PYSEC-2021-10","openSUSE-SU-2024:11225-1","openSUSE-SU-2024:14137-1","openSUSE-SU-2026:11271-1"],"status":"published","title":"SQL Injection via in django-debug-toolbar","description":"A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01941,"percentile":0.80308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2021-04-14T17:27:00Z","modified":"2026-10-20T10:53:47Z","fixes":[{"ecosystem":"PyPI","package":"django-debug-toolbar","fixed_in":["1.11.1","2.2.1","3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-django-debug-toolbar","fixed_in":["4.3-1.2","7.0.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.11.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0a1"},{"fixed":"2.2.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0a1"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.11.1"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.11","0.11.0","1.0","1.0.1","1.1","1.10","1.10.1","1.11","1.2","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0a1"},{"fixed":"2.2.1"}]}],"versions":["2.0","2.0a1","2.1","2.2"]},{"source":"osv","ecosystem":"PyPI","package":"django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0a1"},{"fixed":"3.2.1"}]}],"versions":["3.0","3.0a1","3.0a2","3.0a3","3.0a4","3.1","3.1.1","3.2","3.2a1"]},{"source":"osv","ecosystem":"PyPI","package":"django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.11.1"},{"introduced":"2.0"},{"fixed":"2.2.1"},{"introduced":"3.0"},{"fixed":"3.2.1"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.11","0.11.0","1.0","1.0.1","1.1","1.2","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1","1.10","1.10.1","1.11","2.0","2.1","2.2","3.0","3.1","3.1.1","3.2a1","3.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-1.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-django-debug-toolbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1.1"}]}]}],"products":[{"vendor":"jazzband","product":"django_debug_toolbar"}],"references":[{"url":"https://github.com/jazzband/django-debug-toolbar/releases","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","advisory"]},{"url":"https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30459","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30459","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django-debug-toolbar/PYSEC-2021-10.yaml","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pghf-347x-c2gj"},{"url":"https://github.com/jazzband/django-debug-toolbar","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30459","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-30459","description":"A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.","status":"published","published":"2021-04-14T17:27:00Z","modified":"2024-08-03T22:32:41.14Z","updated_at":"2026-11-02T14:33:02.20241Z"}],"euvd":[{"id":"EUVD-2021-0052","description":"A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.","status":"published","published":"2021-04-14T17:27:00Z","modified":"2024-08-03T22:32:41Z","updated_at":"2026-11-03T03:24:42.48986Z"}],"ghsa":[{"id":"GHSA-pghf-347x-c2gj","title":"SQL Injection via in django-debug-toolbar","description":"### Impact\nWith Django Debug Toolbar attackers are able to execute SQL by changing the `raw_sql` input of the SQL explain, analyze or select forms and submitting the form.\n\n**NOTE:** This is a high severity issue for anyone using the toolbar in a **production environment**.\n\nGenerally the Django Debug Toolbar team only maintains the latest version of django-debug-toolbar, but an exception was made because of the high severity of this issue.\n\n### Patches\nPlease upgrade to one of the following versions, depending on the major version you're using:\n\n- Version 1.x: [django-debug-toolbar 1.11.1](https://pypi.org/project/django-debug-toolbar/1.11.1/)\n- Version 2.x: [django-debug-toolbar 2.2.1](https://pypi.org/project/django-debug-toolbar/2.2.1/)\n- Version 3.x: [django-debug-toolbar 3.2.1](https://pypi.org/project/django-debug-toolbar/3.2.1/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [django-debug-toolbar repo](https://github.com/jazzband/django-debug-toolbar/issues/new)  (Please NO SENSITIVE INFORMATION, send an email instead!)\n* Email us at [security@jazzband.co](mailto:security@jazzband.co)","status":"published","published":"2021-04-16T19:53:28Z","modified":"2024-09-13T20:10:23Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2021-30459","description":"A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.","status":"published","published":"2021-04-14T18:15:14.877Z","modified":"2026-06-17T03:50:17.07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"CVE-2021-30459","description":"A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.","status":"published","published":"2021-04-14T18:15:14.877Z","modified":"2026-10-20T10:53:47.143030481Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"GHSA-pghf-347x-c2gj","title":"SQL Injection via in django-debug-toolbar","description":"### Impact\nWith Django Debug Toolbar attackers are able to execute SQL by changing the `raw_sql` input of the SQL explain, analyze or select forms and submitting the form.\n\n**NOTE:** This is a high severity issue for anyone using the toolbar in a **production environment**.\n\nGenerally the Django Debug Toolbar team only maintains the latest version of django-debug-toolbar, but an exception was made because of the high severity of this issue.\n\n### Patches\nPlease upgrade to one of the following versions, depending on the major version you're using:\n\n- Version 1.x: [django-debug-toolbar 1.11.1](https://pypi.org/project/django-debug-toolbar/1.11.1/)\n- Version 2.x: [django-debug-toolbar 2.2.1](https://pypi.org/project/django-debug-toolbar/2.2.1/)\n- Version 3.x: [django-debug-toolbar 3.2.1](https://pypi.org/project/django-debug-toolbar/3.2.1/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [django-debug-toolbar repo](https://github.com/jazzband/django-debug-toolbar/issues/new)  (Please NO SENSITIVE INFORMATION, send an email instead!)\n* Email us at [security@jazzband.co](mailto:security@jazzband.co)","status":"published","published":"2021-04-16T19:53:28Z","modified":"2026-07-08T06:28:57.97994299Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"openSUSE-SU-2024:11225-1","title":"python36-django-debug-toolbar-3.2.1-1.2 on GA media","description":"These are all security issues fixed in the python36-django-debug-toolbar-3.2.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:25:11.360114Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14137-1","title":"python310-django-debug-toolbar-4.3-1.2 on GA media","description":"These are all security issues fixed in the python310-django-debug-toolbar-4.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T02:56:01.052561Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11271-1","title":"python313-django-debug-toolbar-7.0.0-1.1 on GA media","description":"These are all security issues fixed in the python313-django-debug-toolbar-7.0.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:10.247498497Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2021-10","description":"A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.","status":"published","published":"2021-04-14T18:15:00Z","modified":"2023-11-08T04:05:46.277622Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}