by Kastro
Paper/Archive/CVE-2025-64459

CVE-2025-64459

djangoproject Django — Potential SQL injection via _connector keyword argument in QuerySet and Q objects

EPSS 19%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 97.3.973 × 2019.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.

Affected

ProductAffectedFixed inSource
Django5.2 – < 5.2.85.2.8CNA
Django5.1 – < 5.1.145.1.14CNA
Django4.2 – < 4.2.264.2.26CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorydocs.djangoproject.com/en/dev/releases/securityrefgroups.google.com/g/django-announceadvisorydjangoproject.com/weblog/2025/nov/05/security-releasesrefshivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html