Django is subject to SQL injection through its column aliases
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-57833US | high8.1 | Exploit | ||
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably craft… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/09/03/3WEB
- https://docs.djangoproject.com/en/dev/releases/securityWEB
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5WEB
- https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92WEB
- https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yamlWEB
- https://groups.google.com/g/django-announceWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan