CVE-2025-64459

Name of the Vulnerable Software and Affected Versions Django versions 5.1 through 5.1.13 Django versions 4.2 through 4.2.25 Django versions 5.2 through 5.2.7 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier

Description An issue exists in the QuerySet.filter(), QuerySet.exclude(), and QuerySet.get() methods, as well as the Q() class, where they are subject to SQL injection. This occurs when a suitably crafted dictionary is used with dictionary expansion as the connector argument. An attacker can exploit this by passing internal query parameters through URL query strings or POST data that are then passed directly into these methods. This can lead to database logic manipulation, such as changing AND logic to OR, potentially resulting in authentication bypass, privilege escalation, and the unauthorized disclosure or modification of protected information.

Recommendations Update Django versions 5.1 through 5.1.13 to version 5.1.14. Update Django versions 4.2 through 4.2.25 to version 4.2.26. Update Django versions 5.2 through 5.2.7 to version 5.2.8. Avoid passing user-controlled data, such as request.GET.dict(), directly into QuerySet methods via dictionary expansion. Implement whitelisting of allowed filtering parameters or use explicit field mapping instead of dictionary expansion. Use Django Forms to validate input data. As a temporary mitigation, restrict or audit the use of the connector and negated parameters in incoming requests.