GHSA-r3hx-x5rh-p9vv (django-haystack): affected version range is unparseable ("eval()"), so the advisory matches nothing

Bắt đầu với GHSA-r3hx-x5rh-p9vv và django-haystack#2066, sau đó kiểm tra sink được tham chiếu tại haystack/backends/elasticsearch_backend.py:865 và các phiên bản đã phát hành của dự án. Xác nhận phiên bản bị ảnh hưởng sớm nhất với các maintainer upstream trước khi sửa metadata affected và patched của advisory; công việc được hoàn tất khi khoảng phiên bản có thể được parse và các consumer tự động có thể xác định các bản phát hành bị ảnh hưởng.

Advisory

GHSA-r3hx-x5rh-p9vv — Remote Code Execution via eval() in Elasticsearch Result Deserialization, django-haystack (pip), published 2026-06-04, Moderate.

Problem

The advisory's version metadata is not a version range:

• Affected versions: eval()
• Patched versions: None

eval() appears to be a paste slip from the advisory body (the vulnerable sink is eval(value) at haystack/backends/elasticsearch_backend.py:865).

Impact of the metadata bug

Because the affected range is not a parseable constraint, this advisory cannot match any installed version. In practice that means:

• Dependabot will not raise an alert for any django-haystack user
• pip-audit, OSV-Scanner and other OSV consumers will not flag it
• The advisory is published and visible to humans, but inert to every automated consumer

So a Moderate-severity RCE advisory exists while affected users receive no signal.

Suggested correction

Replace the affected range with a real constraint. django-haystack's latest release is 3.3.0 and the sink is still present on master, so the affected range appears to be all released versions up to and including the current one — e.g. <= 3.3.0, or an ecosystem-specific range once maintainers confirm the earliest affected version. Patched versions should stay empty/none until a fix ships, which is accurate today.

I've also opened django-haystack/django-haystack#2066 asking the maintainers to correct this at source and to consider requesting a CVE, since the advisory currently has none.

Disclosure

I'm the reporter of the underlying vulnerability. Raising this here only because the advisory is already public — nothing undisclosed is included above.