CVE-2025-59681: Django CVE-2025-59681 and CVE-2025-59682
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to these methods (on MySQL and MariaDB).
Other sources
QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), andQuerySet.extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to these methods on MySQL and MariaDB.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 5.2.7 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 5.1.13 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 4.2.25 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 4.2.25-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59681?
CVE-2025-59681 is classified as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-59681?
To fix CVE-2025-59681, upgrade Django to versions 4.2.25, 5.1.13, or 5.2.7 or later.
What products are affected by CVE-2025-59681?
CVE-2025-59681 affects Django versions before 4.2.25, 5.1.13, and 5.2.7.
What kind of attack can be executed through CVE-2025-59681?
CVE-2025-59681 can allow an attacker to perform SQL injection through improperly handled column aliases.
How can I prevent CVE-2025-59681 in my application?
To prevent CVE-2025-59681, ensure that your Django application is running a patched version and avoid using unsafe user inputs in database queries.