GHSA-r3hx-x5rh-p9vv (django-haystack): affected version range is unparseable ("eval()"), so the advisory matches nothing

Comienza con GHSA-r3hx-x5rh-p9vv y django-haystack#2066, después inspecciona el sink referenciado en haystack/backends/elasticsearch_backend.py:865 y las versiones publicadas del proyecto. Confirma con los mantenedores upstream cuál es la primera versión afectada antes de corregir los metadatos affected y patched del advisory; el trabajo está terminado cuando el rango se puede analizar y los consumidores automatizados pueden identificar las versiones afectadas.

Advisory

GHSA-r3hx-x5rh-p9vv — Remote Code Execution via eval() in Elasticsearch Result Deserialization, django-haystack (pip), published 2026-06-04, Moderate.

Problem

The advisory's version metadata is not a version range:

• Affected versions: eval()
• Patched versions: None

eval() appears to be a paste slip from the advisory body (the vulnerable sink is eval(value) at haystack/backends/elasticsearch_backend.py:865).

Impact of the metadata bug

Because the affected range is not a parseable constraint, this advisory cannot match any installed version. In practice that means:

• Dependabot will not raise an alert for any django-haystack user
• pip-audit, OSV-Scanner and other OSV consumers will not flag it
• The advisory is published and visible to humans, but inert to every automated consumer

So a Moderate-severity RCE advisory exists while affected users receive no signal.

Suggested correction

Replace the affected range with a real constraint. django-haystack's latest release is 3.3.0 and the sink is still present on master, so the affected range appears to be all released versions up to and including the current one — e.g. <= 3.3.0, or an ecosystem-specific range once maintainers confirm the earliest affected version. Patched versions should stay empty/none until a fix ships, which is accurate today.

I've also opened django-haystack/django-haystack#2066 asking the maintainers to correct this at source and to consider requesting a CVE, since the advisory currently has none.

Disclosure

I'm the reporter of the underlying vulnerability. Raising this here only because the advisory is already public — nothing undisclosed is included above.