Vulnerability advisory

CVE-2025-59681

Published Oct 1, 2025Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2025-59681GHSA-hpr9-3m2g-3j9pPYSEC-2025-106

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 57d20b2485e7cd2f029dbf49fb5510b2a6f12c48	`57d20b2485e7cd2f029dbf49fb5510b2a6f12c48`
84d09a547fe35e10018ab242602ca76c29ca91a1 to before 467aeeb569da17a7573e8dfc4932434c84e70642	`467aeeb569da17a7573e8dfc4932434c84e70642`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before 3cff3209e35a560f94801d428cf7f2a3ecb2a051	`3cff3209e35a560f94801d428cf7f2a3ecb2a051`
Also listed as affected (7) `5.2.6` `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

CVE-2025-59681

Affected versions

Repository

Description

References