CVE-2024-53908

The vulnerability occurs when an application directly uses the `django.db.models.fields.json.HasKey` class and passes untrusted user data as the left-hand side (lhs) value, with Oracle as the database backend. In such a configuration, input data is not properly sanitized before being embedded in the SQL query, allowing an attacker to inject malicious SQL code. Applications using lookup through the standard `__` interface (e.g., `jsonfield__has_key`) are not vulnerable — the problem only affects direct use of the lookup class.

An attacker can read, modify, or delete data in an Oracle database, and in certain configurations potentially gain control over the database server or escalate privileges in the system.

Django should be updated to version 5.1.4, 5.0.10, or 4.2.17 (depending on the branch in use). Until an update is applied, it is recommended to avoid direct use of `django.db.models.fields.json.HasKey` with untrusted data as the left-hand side value and replace it with lookup through the `__` interface (e.g., `jsonfield__has_key`).

Django 5.1 before version 5.1.4, Django 5.0 before version 5.0.10, Django 4.2 before version 4.2.17 — only in installations using Oracle database.