Vulnerability advisory

CVE-2025-13372

Potential SQL injection in FilteredRelation column aliases on PostgreSQL

Published Dec 2, 2025Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2025-13372GHSA-rqw2-ghq9-44m7PYSEC-2025-104

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 5948e6657f8cb6aeaab1a5a45640d089230f461a	`5948e6657f8cb6aeaab1a5a45640d089230f461a`
84d09a547fe35e10018ab242602ca76c29ca91a1 to before 6ef1f6fbe33e9882f82dae026b527800ecb78c36	`6ef1f6fbe33e9882f82dae026b527800ecb78c36`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before c14b756185c88f7f2eb745ff061f3c221fea9de7	`c14b756185c88f7f2eb745ff061f3c221fea9de7`
Also listed as affected (9) `5.2.8` `5.2.7` `5.2.6` `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

CVE-2025-13372

Affected versions

Repository

Description

References