What’s Vulnerable › Vulnerabilities

CVE-2025-57833: Django is subject to SQL injection through its column aliases

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 26.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-03 · updated 2026-06-17
• Weakness: CWE-89

Description

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Affected products

• Django: from 4.2 before 4.2.24; from 5.1 before 5.1.12; from 5.2 before 5.2.6 — fixed in 4.2.24, 5.1.12, 5.2.6
• Pypi Django: before 4.2.24; from 5.0a1 before 5.1.12; from 5.2a1 before 5.2.6; 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1, 1.1.1 (+396) — fixed in 4.2.24, 5.1.12, 5.2.6

How to fix

Upgrade to a fixed version: Django 4.2.24, 5.1.12, 5.2.6; Pypi Django 4.2.24, 5.1.12, 5.2.6. Check the vendor advisory for mitigations.

References

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases/
• http://www.openwall.com/lists/oss-security/2025/09/03/3
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html

Get alerted when CVE-2025-57833 or the next vulnerability affects your stack