Executive brief
Django, a popular web framework for building Python applications, is vulnerable to a security flaw when used with PostgreSQL databases. An attacker could potentially execute unauthorized database commands by providing specially crafted data to certain database query functions. This could lead to unauthorized access to sensitive information stored in the database.
Technical details
A SQL injection vulnerability exists in Django's FilteredRelation component when used with PostgreSQL. The flaw occurs in column aliases when a suitably crafted dictionary is passed via dictionary expansion (**kwargs) to QuerySet.annotate() or QuerySet.alias(). An attacker can exploit this to manipulate SQL queries, potentially leading to unauthorized data retrieval. The vulnerability is present in Django versions 5.2, 5.1, and 4.2; users are advised to upgrade to versions 5.2.9, 5.1.15, or 4.2.27 respectively. Older unsupported versions like 5.0.x and 3.2.x may also be affected.
Affected products
- Django Software Foundation Django >= 5.2a1, < 5.2.9
- Django Software Foundation Django >= 5.1a1, < 5.1.15
- Django Software Foundation Django >= 4.2a1, < 4.2.27
Timeline
- 2025-12-02: advisory: Security release announcement by Django project
- 2025-12-02: patched: Fixes released in versions 5.2.9, 5.1.15, and 4.2.27
References
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/dec/02/security-releases
- https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf
- https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0