CriticalFix available
python-django — security advisory
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
- Products
- python-django
- Affected versions
- 3:3.2.19-1, 3:3.2.19-1+deb12u1, 3:3.2.19-1+deb12u1~bpo11+1, 3:3.2.19-1+deb12u2, 3:3.2.20-1, 3:3.2.20-1.1, 3:3.2.21-1, 3:4.2.23-1, 3:4.2.24-1, 3:4.2.25-1, 3:4.2.25-2, 3:4.2.26-1
- Fixed versions
- 3:3.2.25-0+deb12u1, 3:4.2.25-1, 3:4.2.27-0+deb13u1
- CVEs
- CVE-2025-59681
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 09:03 UTC · Revision 1
Source evidence
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
osv:DEBIAN-CVE-2025-59681
python-django
Fixed versions: 3:3.2.25-0+deb12u1
python-django
Fixed versions: 3:4.2.27-0+deb13u1
python-django
Fixed versions: 3:4.2.25-1
Complete source record
{
"id": "77b7c2bd125dc223931c43e3735346d52d5d2de07e58a4f3502c45bf48c9ccd8",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2025-59681",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2025-59681",
"summary": "An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).",
"evidence": "osv:DEBIAN-CVE-2025-59681",
"products": [
{
"name": {
"value": "python-django",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:3.2.25-0+deb12u1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "3:3.2.19-1",
"evidence": "/affected/0/versions"
},
{
"value": "3:3.2.19-1+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3:3.2.19-1+deb12u1~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "3:3.2.19-1+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3:3.2.20-1",
"evidence": "/affected/0/versions"
},
{
"value": "3:3.2.20-1.1",
"evidence": "/affected/0/versions"
},
{
"value": "3:3.2.21-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python-django",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:4.2.27-0+deb13u1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3:4.2.23-1",
"evidence": "/affected/1/versions"
},
{
"value": "3:4.2.24-1",
"evidence": "/affected/1/versions"
},
{
"value": "3:4.2.25-1",
"evidence": "/affected/1/versions"
},
{
"value": "3:4.2.25-2",
"evidence": "/affected/1/versions"
},
{
"value": "3:4.2.26-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python-django",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:4.2.25-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3:4.2.23-1",
"evidence": "/affected/2/versions"
},
{
"value": "3:4.2.24-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2025-59681",
"aliases": [
"DEBIAN-CVE-2025-59681"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:3.2.25-0+deb12u1"
}
]
}
],
"package": {
"name": "python-django",
"purl": "pkg:deb/debian/python-django?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3:3.2.19-1",
"3:3.2.19-1+deb12u1",
"3:3.2.19-1+deb12u1~bpo11+1",
"3:3.2.19-1+deb12u2",
"3:3.2.20-1",
"3:3.2.20-1.1",
"3:3.2.21-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-59681.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:4.2.27-0+deb13u1"
}
]
}
],
"package": {
"name": "python-django",
"purl": "pkg:deb/debian/python-django?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3:4.2.23-1",
"3:4.2.24-1",
"3:4.2.25-1",
"3:4.2.25-2",
"3:4.2.26-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-59681.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:4.2.25-1"
}
]
}
],
"package": {
"name": "python-django",
"purl": "pkg:deb/debian/python-django?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3:4.2.23-1",
"3:4.2.24-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-59681.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-13T09:47:33.239950288Z",
"provider": "osv",
"upstream": [
"CVE-2025-59681"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2025-59681"
]
},
"related_cves": [
{
"value": "CVE-2025-59681",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 307571,
"published_at": "2025-10-01T19:15:36.487+00:00"
}