Django SQL Injection in cursor.execute()

CRITICAL

SQL injection vulnerability: User input flows to cursor.execute() without parameterization within a function. Use parameterized queries with %s placeholders.

Rule Information

Language
Python
Category
Django
Author
Code Pathfinder
Last Updated
2026-01-17
Tags
pythondjangosql-injectionormdatabaseowasp-a03cwe-89parameterizationcursorintra-proceduralcriticalsecurity
CWE References
CWE-89
CVE References
CVE-2022-34265

Interactive Playground

Experiment with the vulnerable code and security rule below. Edit the code to see how the rule detects different vulnerability patterns.

pathfinder ci --ruleset python/PYTHON-DJANGO-001 --project .
Vulnerable Code
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
Security Rule

Frequently Asked Questions

Common questions about Django SQL Injection in cursor.execute()

SQL injection vulnerability: User input flows to cursor.execute() without parameterization within a function. Use parameterized queries with %s placeholders.
This vulnerability is rated as CRITICAL severity, which means it requires immediate attention and can lead to severe security breaches such as remote code execution, complete system compromise, or massive data breaches.

Use Code Pathfinder to scan your Python codebase and automatically detect instances of this vulnerability pattern. Install Code Pathfinder and run the following command in your project directory:

pathfinder ci --ruleset python/PYTHON-DJANGO-001 --project .

This rule is aligned with industry-standard security frameworks and classifications:

  • CWE (Common Weakness Enumeration): CWE-89
  • CVE (Common Vulnerabilities and Exposures): CVE-2022-34265
  • Tags: python, django, sql-injection, orm, database, owasp-a03, cwe-89, parameterization, cursor, intra-procedural, critical, security
Yes! Code Pathfinder allows you to customize rules to match your specific security requirements and coding standards. You can modify the detection patterns, adjust severity levels, add custom sanitizers, and configure the rule to fit your organization's security policies. The interactive playground above lets you experiment with the rule and see how it behaves with different code patterns.
When this vulnerability is detected in your code, review the flagged instances carefully. Check the "Vulnerable Code" section above for examples of insecure patterns and the "Security Rule" section to understand what the rule is looking for. Follow security best practices for Python and consult the CWE/CVE references for detailed remediation guidance. Always test your fixes thoroughly before deploying to production.

New feature

Get these findings posted directly on your GitHub pull requests

The Django SQL Injection in cursor.execute() rule runs in CI and posts inline review comments on the exact lines — no dashboard, no SARIF viewer.

See how it works
Back to DjangoAll Languages →