CVE-2025-13372
Fixed in a distro release EPSS <1%CVSS 4.3
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 5.2.9 |
| PyPI | django | 5.1.15 |
| PyPI | django | 4.2.27 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | authentik | 2025.10.2-r2 |
| Chainguard | authentik-go-server | 2025.10.2-r2 |
| Chainguard | awx | 24.6.1-r20 |
| Debian 12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian 13 | python-django | 3:4.2.27-0+deb13u1 |
| Debian 14 | python-django | 3:4.2.27-1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.44.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python-Django | 4.2.11-150600.3.44.1 |
| Ubuntu 22.04 LTS | python-django | 2:3.2.12-2ubuntu1.24 |
| Ubuntu 24.04 LTS | python-django | 3:4.2.11-1ubuntu1.13 |
| Ubuntu 25.10 | python-django | 3:5.2.4-1ubuntu2.2 |
| Ubuntu 26.04 LTS | python-django | 3:5.2.9-0ubuntu1 |
| Ubuntu Pro 14.04 LTS | python-django | 1.6.11-0ubuntu1.3+esm9 |
| Ubuntu Pro 16.04 LTS | python-django | 1.8.7-1ubuntu5.15+esm10 |
| Ubuntu Pro 18.04 LTS | python-django | 1:1.11.11-1ubuntu1.21+esm13 |
| Ubuntu Pro 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.29+esm6 |
| openSUSE Leap 15.6 | python-Django | 4.2.11-150600.3.44.1 |
| openSUSE Leap 16.0 | python-Django | 5.2.4-bp160.4.1 |
| openSUSE Tumbleweed | python-Django | 5.2.9-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.27-1.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |