CVE-2025-13372
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.
- CVSS 3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-25)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rqw2-ghq9-44m7 | PyPI | django | >=5.2a1 <5.2.9 | 5.2.9 |
| GHSA-rqw2-ghq9-44m7 | PyPI | django | >=5.1a1 <5.1.15 | 5.1.15 |
| GHSA-rqw2-ghq9-44m7 | PyPI | django | >=4.2a1 <4.2.27 | 4.2.27 |
| PYSEC-2025-104 | PyPI | django | >=4.2 <4.2.27 >=5.1 <5.1.15 >=5.2 <5.2.9 | 4.2.27, 5.1.15, 5.2.9 |