---
title: "Django 5.1.4 リリースノート"
version: 6.1
locale: ja
source: https://docs.djangoproject.com/ja/6.1/releases/5.1.4/
canonical: https://djangodocs.dev/ja/6.1/releases/5.1.4/
---
# Django 5.1.4 リリースノート

*2024年12月4日*

Django 5.1.4 では、 5.1.3 におけるセキュリティの問題のうち深刻度 "high" 1件、深刻度 "moderate" 1件を含め、いくつかのバグを修正しました。

## CVE-2024-53907: `strip_tags()` における DoS 攻撃の可能性

[`strip_tags()`](/ja/6.1/ref/utils/#django.utils.html.strip_tags) would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The `strip_tags()` method is used to implement the corresponding
[`striptags`](/ja/6.1/ref/templates/builtins/#std-templatefilter-striptags) template filter, which was thus also vulnerable.

`strip_tags()` now has an upper limit of recursive calls to `HTMLParser`
before raising a [`SuspiciousOperation`](/ja/6.1/ref/exceptions/#django.core.exceptions.SuspiciousOperation) exception.

Remember that absolutely NO guarantee is provided about the results of
`strip_tags()` being HTML safe. So NEVER mark safe the result of a
`strip_tags()` call without escaping it first, for example with
[`django.utils.html.escape()`](/ja/6.1/ref/utils/#django.utils.html.escape).

## CVE-2024-53908: Potential SQL injection via `HasKey(lhs, rhs)` on Oracle

Direct usage of the `django.db.models.fields.json.HasKey` lookup on Oracle
was subject to SQL injection if untrusted data was used as a `lhs` value.

Applications that use the [`has_key`](/ja/6.1/topics/db/queries/#std-fieldlookup-jsonfield.has_key) lookup through
the `__` syntax are unaffected.

## バグ修正

- Fixed a crash in `createsuperuser` on Python 3.13+ caused by an unhandled
  `OSError` when the username could not be determined ([#35942](https://code.djangoproject.com/ticket/35942)).
- Fixed a regression in Django 5.1 where relational fields were not updated
  when calling `Model.refresh_from_db()` on instances with deferred fields
  ([#35950](https://code.djangoproject.com/ticket/35950)).