CVE-2026-43948: Django Modelform Instance Field Tautological Comparison
`form.instance.FIELD` always holds the pre-submission value of the bound instance because Django ModelForm.is_valid() never mutates the instance. When `form = SomeForm(data=request.POST, instance=obj)`, then `form.instance` IS `obj`, so `obj.FIELD != form.instance.FIELD` is a tautological comparison that is permanently False. Any email-verification, change-d
Pythongreprules fetch cve-2026-43948-django-modelform-instance-field-tautological-comparison --engine opengrepDescription
`form.instance.FIELD` always holds the pre-submission value of the bound instance because Django ModelForm.is_valid() never mutates the instance. When `form = SomeForm(data=request.POST, instance=obj)`, then `form.instance` IS `obj`, so `obj.FIELD != form.instance.FIELD` is a tautological comparison that is permanently False. Any email-verification, change-d
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.