by Kastro
Paper/Archive/CVE-2025-59681

CVE-2025-59681

djangoproject Django — An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.5.505 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

Affected

ProductAffectedFixed inSource
Django4.2 – < 4.2.254.2.25CNA
Django5.1 – < 5.1.135.1.13CNA
Django5.2 – < 5.2.75.2.7CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre (CNA)7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdocs.djangoproject.com/en/dev/releases/securityrefgroups.google.com/g/django-announcerefdjangoproject.com/weblog/2025/oct/01/security-releasesrefopenwall.com/lists/oss-security/2025/10/01/3