~ / search / GHSA-hpr9-3m2g-3j9p

GHSA-hpr9-3m2g-3j9p

Django vulnerable to SQL injection in column aliases

Source: GitHub Advisory Database (reviewed) High CVE-2025-59681

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 4.2, < 4.2.25 4.2.25
PyPI Django >= 5.1, < 5.1.13 5.1.13
PyPI Django >= 5.2, < 5.2.7 5.2.7

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

References

External links from the advisory. They lead to third-party sites.