Junglewise Threat Intelligence

CVE-2025-13372: Django SQL injection in FilteredRelation column aliases on PostgreSQL

CVE-2025-13372 · Severity: medium · CVSS 4.3 · Published 2025-12-02

Technologies: Django (PyPI). Vendors: PyPI.

Executive brief

Django, a popular web framework for building Python applications, is vulnerable to a security flaw when used with PostgreSQL databases. An attacker could potentially execute unauthorized database commands by providing specially crafted data to certain database query functions. This could lead to unauthorized access to sensitive information stored in the database.

Technical details

A SQL injection vulnerability exists in Django's FilteredRelation component when used with PostgreSQL. The flaw occurs in column aliases when a suitably crafted dictionary is passed via dictionary expansion (**kwargs) to QuerySet.annotate() or QuerySet.alias(). An attacker can exploit this to manipulate SQL queries, potentially leading to unauthorized data retrieval. The vulnerability is present in Django versions 5.2, 5.1, and 4.2; users are advised to upgrade to versions 5.2.9, 5.1.15, or 4.2.27 respectively. Older unsupported versions like 5.0.x and 3.2.x may also be affected.

Affected products

  • Django Software Foundation Django >= 5.2a1, < 5.2.9
  • Django Software Foundation Django >= 5.1a1, < 5.1.15
  • Django Software Foundation Django >= 4.2a1, < 4.2.27

Timeline

  • 2025-12-02: advisory: Security release announcement by Django project
  • 2025-12-02: patched: Fixes released in versions 5.2.9, 5.1.15, and 4.2.27

References

Related threats