CVE-2026-29055: Django Db Lower In Membership Test

Django's database expression `Lower(...)` was used in a Python membership test instead of `str.lower()`. `Lower(...)` returns an Expression object, causing membership checks against string collections to always evaluate incorrectly.

Provally CuratedPublic repositoryMediumHigh confidenceVerifiedApache-2.0Python
greprules fetch cve-2026-29055-django-db-lower-in-membership-test --engine opengrep

Description

Django's database expression `Lower(...)` was used in a Python membership test instead of `str.lower()`. `Lower(...)` returns an Expression object, causing membership checks against string collections to always evaluate incorrectly.