Vulnerability · Published Oct 1, 2025 · Assigned by mitre
CVE-2025-59681
High 7.1
In plain English
A high-severity SQL injection in Django from djangoproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | py3-django | 4.2.25-r0 | ALPINE-CVE-2025-59681 |
| Alpine:v3.23 | py3-django | 4.2.25-r0 | ALPINE-CVE-2025-59681 |
| Alpine:v3.24 | py3-django | 4.2.25-r0 | ALPINE-CVE-2025-59681 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u1 | DSA-6136-1 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u1 | DEBIAN-CVE-2025-59681 |
| Debian:13 | python-django | 3:4.2.27-0+deb13u1 | DSA-6117-1 |
| Debian:13 | python-django | 3:4.2.27-0+deb13u1 | DEBIAN-CVE-2025-59681 |
| Debian:14 | python-django | 3:4.2.25-1 | DEBIAN-CVE-2025-59681 |
| PyPI | django | 4.2.25, 5.1.13, 5.2.7 | PYSEC-2025-106 |
| PyPI | django | 5.2.7 | GHSA-hpr9-3m2g-3j9p |
| PyPI | django | 5.1.13 | GHSA-hpr9-3m2g-3j9p |
| PyPI | django | 4.2.25 | GHSA-hpr9-3m2g-3j9p |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.22 | USN-7794-1 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.22 | UBUNTU-CVE-2025-59681 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.11 | UBUNTU-CVE-2025-59681 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.11 | USN-7794-1 |
| Ubuntu:25.10 | python-django | 3:5.2.4-1ubuntu2 | UBUNTU-CVE-2025-59681 |
| Ubuntu:26.04:LTS | python-django | 3:5.2.4-1ubuntu2 | UBUNTU-CVE-2025-59681 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| djangoproject | Django | 4.2 – before 4.2.255.1 – before 5.1.135.2 – before 5.2.7 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N