CVE-2025-59681: Django CVE-2025-59681 and CVE-2025-59682
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to these methods (on MySQL and MariaDB).
Other sources
QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), andQuerySet.extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to these methods on MySQL and MariaDB.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59681?
CVE-2025-59681 is classified as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-59681?
To fix CVE-2025-59681, upgrade Django to versions 4.2.25, 5.1.13, or 5.2.7 or later.
What products are affected by CVE-2025-59681?
CVE-2025-59681 affects Django versions before 4.2.25, 5.1.13, and 5.2.7.
What kind of attack can be executed through CVE-2025-59681?
CVE-2025-59681 can allow an attacker to perform SQL injection through improperly handled column aliases.
How can I prevent CVE-2025-59681 in my application?
To prevent CVE-2025-59681, ensure that your Django application is running a patched version and avoid using unsafe user inputs in database queries.