Fluid Attacks Database

Description

Django is subject to SQL injection through its column aliases An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	python-django	=3:3.2.19-1 \|\| =3:3.2.19-1+deb12u1 \|\| =3:3.2.19-1+deb12u1~bpo11+1 \|\| =3:3.2.19-1+deb12u2 \|\| =3:3.2.20-1 \|\| =3:3.2.20-1.1 \|\| =3:3.2.21-1 \|\| >=0 <3:3.2.25-0+deb12u1	3:3.2.25-0+deb12u1
debian 11	python-django	=2:2.2.24-1 \|\| =2:2.2.25-1~deb11u1 \|\| =2:2.2.26-1~deb11u1 \|\| =2:2.2.28-1~deb11u1 \|\| =2:2.2.28-1~deb11u2 \|\| =2:2.2.28-1~deb11u3 \|\| =2:2.2.28-1~deb11u4 \|\| =2:2.2.28-1~deb11u5 \|\| =2:2.2.28-1~deb11u6 \|\| =2:2.2.28-1~deb11u7 \|\| >=0 <2:2.2.28-1~deb11u8	2:2.2.28-1~deb11u8
debian 13	python-django	=3:4.2.23-1 \|\| =3:4.2.24-1 \|\| =3:4.2.25-1 \|\| =3:4.2.25-2 \|\| =3:4.2.26-1 \|\| >=0 <3:4.2.27-0+deb13u1	3:4.2.27-0+deb13u1
debian 14	python-django	=3:4.2.23-1 \|\| >=0 <3:4.2.24-1	3:4.2.24-1
pypi	django	>=0 <4.2.24 \|\| >=5.0a1 <5.1.12 \|\| >=5.2a1 <5.2.6	4.2.24, 5.1.12, 5.2.6

Aliases

1. CVE-2025-578332. NVD-2025-578333. OSV-DEBIAN-2025-578334. OSV-2025-578335. GCVE-2025-578336. SECURITY-TRACKER-CVE-2025-578337. lists.debian.org

References

1. https://github.com/Mkway/CVE-2025-578332. https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef53. https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a924. https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d2435. https://docs.djangoproject.com/en/dev/releases/security6. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml7. https://groups.google.com/g/django-announce8. https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f8989. https://www.djangoproject.com/weblog/2025/sep/03/security-releases10. http://www.openwall.com/lists/oss-security/2025/09/03/3