CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
| Software | From | Fixed in |
|---|---|---|
Django
|
4.2 | 4.2.25 |
|
Django
|
5.1 | 5.1.13 |
|
Django
|
5.2 | 5.2.7 |
| djangoproject / django | 4.2 | 4.2.25 |
| djangoproject / django | 5.1 | 5.1.13 |
| djangoproject / django | 5.2 | 5.2.7 |
- http://www.openwall.com/lists/oss-security/2025/10/01/3
- https://docs.djangoproject.com/en/dev/releases/security
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a
- https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/oct/01/security-releases
- https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime