CVE-2025-59681

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.25 Django versions 5.1 through 5.1.13 Django versions 5.2 through 5.2.7

Description A SQL injection issue exists in Django’s QuerySet methods—specifically annotate(), alias(), aggregate(), and extra()—when using a crafted dictionary with dictionary expansion as the kwargs passed to these methods on MySQL and MariaDB databases. The issue affects column aliases.

Recommendations Update to Django version 4.2.25 or later. Update to Django version 5.1.13 or later. Update to Django version 5.2.7 or later.