Vulnerability advisory

CVE-2025-64459

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

Published Nov 5, 2025Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2025-64459GHSA-frmv-pr5f-9mcrPYSEC-2025-108

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 0dfd59e2d5c713510c6bcf245e8ac2d5b2043a0a	`0dfd59e2d5c713510c6bcf245e8ac2d5b2043a0a`
84d09a547fe35e10018ab242602ca76c29ca91a1 to before da443c4d5472dfc5afe2567b59123da8372715fe	`da443c4d5472dfc5afe2567b59123da8372715fe`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before 47fe39af56ecd0ad73b9c7562511015e96b91b80	`47fe39af56ecd0ad73b9c7562511015e96b91b80`
Also listed as affected (8) `5.2.7` `5.2.6` `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.

CVE-2025-64459

Affected versions

Repository

Description

References