A flaw in django‑haystack’s more_like_this template tag handler (the _to_python function in haystack/backends/elasticsearch_backend.py) allows an attacker to supply a crafted value_class argument that is improperly neutralized before being passed to Python’s eval, enabling the execution of arbitrary Python code on the host running the Django application. The vulnerability is contained in the search library and results in compromise of confidentiality, integrity, and availability for the underlying system, as the executed code runs with the same privileges as the web application process.

The issue affects the django‑haystack Python search library versions up to and including 3.3.0; a fix was released in 3.4.0 (commit eb05f193c9771a68dcc8cfac6674a0d48a52ee9d). The library is commonly used in Django applications that interface with Elasticsearch for search functionality, and the weakness resides in template rendering logic rather than the operating system.

With a CVSS score of 5.1 the flaw is rated moderate, yet it unlocks remote code execution via a template tag that is accessible to any remote client that can render templates. EPSS data is not available, the vulnerability is not listed in the CISA KEV catalog, but public exploit code exists; therefore an unpatched deployment remains at ongoing risk.