Executive brief
Django, a popular web framework used to build websites, is vulnerable to a serious security flaw that could allow attackers to manipulate database queries. By sending specially crafted data to certain search or filtering functions, an attacker could potentially view, modify, or delete sensitive information stored in the application's database. This issue affects several versions of Django and requires immediate patching to protect user data and maintain system integrity.
Technical details
A SQL injection vulnerability exists in Django's QuerySet methods (filter(), exclude(), get()) and the Q() class. The flaw is triggered when a crafted dictionary is passed as the _connector keyword argument using dictionary expansion. An attacker can exploit this to inject arbitrary SQL commands into the database query. The vulnerability stems from improper neutralization of special elements in the _connector argument. Patches are available in versions 5.2.8, 5.1.14, and 4.2.26.
Affected products
- Django Software Foundation Django >= 5.2a1, < 5.2.8; >= 5.0a1, < 5.1.14; < 4.2.26
Timeline
- 2025-11-05: disclosed
- 2025-11-05: patched
- 2025-11-05: advisory