CVE-2025-13372

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.26 Django versions 5.1 through 5.1.14 Django versions 5.2 through 5.2.8 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier

Description An issue exists in Django where FilteredRelation is susceptible to SQL injection in column aliases. This occurs when a crafted dictionary is used with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Approximately 1.7 million potentially affected devices have been identified. The issue involves the use of the QuerySet.annotate() and QuerySet.alias() functions, which can be exploited through manipulated column aliases. The vulnerable component is FilteredRelation.

Recommendations Update to Django version 5.2.9 or later. Update to Django version 5.1.15 or later. Update to Django version 4.2.27 or later.