A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1…
Priority MEDIUM 46CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
Why it matters now
EPSS 0.01941 80th percentileScored 2026-11-07
Fix Fixed django-debug-toolbar (PyPI): 1.11.1, 2.2.1, 3.2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | django-debug-toolbar (PyPI) | 0.10.0 to before 1.11.1 | 1.11.1 | Patch available | GHSA-pghf-347x-c2gj |
| — | django-debug-toolbar (PyPI) | 2.0a1 to before 2.2.1 | 2.2.1 | Patch available | GHSA-pghf-347x-c2gj |
| — | django-debug-toolbar (PyPI) | 3.0a1 to before 3.2.1 | 3.2.1 | Patch available | GHSA-pghf-347x-c2gj |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- django-debug-toolbar (PyPI) Vendor— Affected 0.10.0 to before 1.11.1 Fixed in 1.11.1 Patch available GHSA-pghf-347x-c2gj
- django-debug-toolbar (PyPI) Vendor— Affected 2.0a1 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-pghf-347x-c2gj
- django-debug-toolbar (PyPI) Vendor— Affected 3.0a1 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-pghf-347x-c2gj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jazzband:django_debug_toolbar:*:*:*:*:*:*:*:* | 0.10.0 to before 1.11.1; 2.0.0 to before 2.2.1; 3.0.0 to before 3.2.1 | Vulnerable | Jazzband |
- cpe:2.3:a:jazzband:django_debug_toolbar:*:*:*:*:*:*:*:* Versions 0.10.0 to before 1.11.1; 2.0.0 to before 2.2.1; 3.0.0 to before 3.2.1 Vulnerable ·Jazzband
Remediation
- Fix · GHSA-pghf-347x-c2gj django-debug-toolbar (PyPI) Fixed in 1.11.1 Advisory →
- Fix · GHSA-pghf-347x-c2gj django-debug-toolbar (PyPI) Fixed in 2.2.1 Advisory →
- Fix · GHSA-pghf-347x-c2gj django-debug-toolbar (PyPI) Fixed in 3.2.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2021-30459
- 2026-10-03 Alias added: GHSA-pghf-347x-c2gj
References
Advisory 3
Sources
- CVE-2021-30459 · CVE Program
- CVE-2021-30459 · NVD
- FIRST EPSS
- GHSA-pghf-347x-c2gj · GitHub Advisory Database · CC BY 4.0
- CVE-2021-30459 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences