Vulnerability advisory

CVE-2025-57833

Published Sep 3, 2025Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2025-57833GHSA-6w2r-r2m5-xq5wPYSEC-2025-105

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 5e23d8900201ba10bf76adf825179c72cbf2e1e2	`5e23d8900201ba10bf76adf825179c72cbf2e1e2`
84d09a547fe35e10018ab242602ca76c29ca91a1 to before f71d9c35e4c28614b4c079462f135637a59bfe19	`f71d9c35e4c28614b4c079462f135637a59bfe19`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before 75c4403f07b8ad25893f7832dbe8fc6814b53b2d	`75c4403f07b8ad25893f7832dbe8fc6814b53b2d`
Also listed as affected (6) `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

CVE-2025-57833

Affected versions

Repository

Description

References