CVE-2025-59681 — Vulnerability in django — CVE Details
CRITICAL
Published October 1, 2025Updated June 10, 2026Source: osv
Summary
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
Advisory Timeline
- First published October 1, 2025 (376 days ago).
- Last revised June 10, 2026 — 252 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
pip
Update django to 4.2.25 or laterpip install "django>=4.2.25"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
Affects 1 ecosystem: pypi (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| django | pypi | 4.2, 4.2.1, 4.2.10, 4.2.11 (+41 more) | 4.2.25, 5.1.13, 5.2.7 |
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.openwall.com/lists/oss-security/2025/10/01/3WEB
- https://docs.djangoproject.com/en/dev/releases/security/ADVISORY
- https://groups.google.com/g/django-announceADVISORY
- https://www.djangoproject.com/weblog/2025/oct/01/security-releases/ADVISORY
- https://github.com/advisories/GHSA-hpr9-3m2g-3j9pADVISORY
Frequently Asked Questions
- What is CVE-2025-59681?
- This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2025-59681?
- CVE-2025-59681 affects django. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-59681 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
PYSEC-2025-106
BIT-django-2025-59681
GHSA-hpr9-3m2g-3j9p
Related CVEs
- CVE-2022-23833HIGH
Infinite Loop in Django
- CVE-2025-57833HIGH
Django is subject to SQL injection through its column aliases
- CVE-2021-33203MEDIUM
Path Traversal in Django
- CVE-2019-11358MEDIUM
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
- CVE-2021-28658
- CVE-2021-31542
- CVE-2021-35042
- CVE-2021-44420
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies