CVE-2025-57833: Django: Potential SQL injection in Filtedlation column aliases
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate() or QuerySet.alias().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57833?
CVE-2025-57833 is considered a critical vulnerability due to its potential for SQL injection.
How do I fix CVE-2025-57833?
To fix CVE-2025-57833, upgrade to Django version 4.2.24, 5.1.12, or 5.2.6 or later.
What are the affected versions for CVE-2025-57833?
CVE-2025-57833 affects Django versions prior to 4.2.24, 5.1.12, and 5.2.6.
What functionality is impacted by CVE-2025-57833?
CVE-2025-57833 impacts the filteredRelation feature in Django, allowing for potential SQL injection via column aliases.
Is CVE-2025-57833 specific to certain implementations of Django?
Yes, CVE-2025-57833 is specifically applicable to Django implementations utilizing the QuerySet.annotate() or QuerySet.alias() methods.