Executive brief
Django, a popular web framework for building Python applications, is vulnerable to a security flaw that could allow an attacker to execute unauthorized database commands. By providing specially crafted data to certain database query functions, an attacker could potentially access or modify sensitive information stored in the application's database. This issue primarily affects applications that allow user-controlled input to influence how database results are labeled or filtered.
Technical details
A SQL injection vulnerability exists in Django's FilteredRelation component. The root cause is improper neutralization of special elements in column aliases when using dictionary expansion (**kwargs) passed to QuerySet.annotate() or QuerySet.alias(). An attacker with low privileges can exploit this over the network by providing a suitably crafted dictionary to these methods, potentially leading to unauthorized data access or modification. The vulnerability is mitigated by high attack complexity, as it requires specific application logic that exposes these internal QuerySet methods to user-influenced dictionary keys. Patches are available in versions 4.2.24, 5.1.12, and 5.2.6.
Affected products
- Django Software Foundation Django 4.2 before 4.2.24, 5.1 before 5.1.12, 5.2 before 5.2.6
Timeline
- 2025-09-03: advisory: Initial security release by Django project
- 2025-09-08: disclosed: GitHub Advisory published
References
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
- https://www.djangoproject.com/weblog/2025/sep/03/security-releases
- https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5