High, CVSS 8.7PyPIAmendedPublished
django-haystack: Remote Code Execution via eval() in Elasticsearch Result Deserialization
CVE-2026-105315 · GHSA-r3hx-x5rh-p9vv
- Affected
- PyPI django-haystack < 3.4.0
- Fixed in
- 3.4.0· Vendor fix available
- Issue
- Remote Code Execution via eval() in Elasticsearch Result Deserialization Summary The Elasticsearch backend in django-haystack calls eval() on raw field values returned from Elasticsearch when a SearchField is declared with an indexfieldname alias that differs from the logical field name. During result processing, the backend looks up fields by logical name but Elasticsearch stores them under the alias key; the lookup fails and the value falls through to topython() → eval(). An attacker who can control content that is indexed into Elasticsearch—and can trigger or wait for a search that returns it—achieves arbitrary code execution in the Django application process. CVSS 3.1 Base Score: 8.5 (High). Details Sink — haystack/backends/elasticsearchbackend.py:865: topython() (line ~850) attempts to parse a string value by calling eval() before performing any type-safety check. If the value is an attacker-controlled Python expression such as import('os').system(...), the expression is…
Recommended action: Upgrade to 3.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.