~ / search / GHSA-mjgh-79qc-68w3

GHSA-mjgh-79qc-68w3

Django has a Race Condition vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2026-25674

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 6.0, < 6.0.3 6.0.3
PyPI Django >= 5.2, < 5.2.12 5.2.12
PyPI Django >= 4.2, < 4.2.29 4.2.29

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

References

External links from the advisory. They lead to third-party sites.