Django vulnerable to SQL injection in column aliases
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-59681US | critical9.8 | — | ||
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/10/01/3WEB
- https://docs.djangoproject.com/en/dev/releases/securityWEB
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494aWEB
- https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66eWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-106.yamlWEB
- https://groups.google.com/g/django-announceWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-59681ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan