AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.

MediumVulnerability

CVE-2026-105315: A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file…

Source: NVD(opens in a new tab)
Identifier: CVE-2026-105315
Published: October 5, 2026
Record updated: October 9, 2026

Summary

A vulnerability in django-haystack up to 3.3.0 affects the function _to_python in haystack/backends/elasticsearch_backend.py, part of the more_like_this Template Tag Handler component. Manipulating the argument result_class leads to improper neutralization of directives in dynamically evaluated code, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

Mitigation

Upgrade to version 3.4.0. The patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

Details

Scores and exploitation

CVSS score: 4.7(medium)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector: network
Attack complexity: low
Privileges required: high
User interaction: none
EPSS: Not scored. FIRST has not published an EPSS score for this CVE yet.
Disclosure date: October 5, 2026

Weaknesses and techniques

Weakness (CWE): CWE-94
CWE-95
Attack pattern (CAPEC): CAPEC-242

Classification

Attack sophistication: Moderate
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-105315

First tracked: October 5, 2026 at 02:08 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)