What’s Vulnerable › Vulnerabilities

CVE-2021-30459

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-14 · updated 2026-06-17
• Weakness: CWE-89

Description

A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.

Affected products

• Jazzband Django Debug Toolbar: from 0.10.0 before 1.11.1; from 2.0.0 before 2.2.1; from 3.0.0 before 3.2.1 — fixed in 1.11.1, 2.2.1, 3.2.1

How to fix

Upgrade to a fixed version: Jazzband Django Debug Toolbar 1.11.1, 2.2.1, 3.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/jazzband/django-debug-toolbar/releases
• https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
• https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/
• https://github.com/jazzband/django-debug-toolbar/releases
• https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
• https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/

Get alerted when CVE-2021-30459 or the next vulnerability affects your stack