PyPI: django
CVE-2025-59681
Safety vulnerability ID: SFTY-20251001-06055
Safety legacy ID: pyup.io-80041
Affected versions of the Django package are vulnerable to SQL Injection due to insufficient neutralization of user-controlled column alias names provided via dictionary expansion. The QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods accept **kwargs whose keys are used as column aliases, and on MySQL and MariaDB, those identifiers are not safely quoted, permitting crafted input to be incorporated into the generated SQL.
Overview
Django vulnerable to SQL injection in column aliases
Advisory
Affected versions of the Django package are vulnerable to SQL Injection due to insufficient neutralization of user-controlled column alias names provided via dictionary expansion. The QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods accept **kwargs whose keys are used as column aliases, and on MySQL and MariaDB, those identifiers are not safely quoted, permitting crafted input to be incorporated into the generated SQL.
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20251001-06055/CVE-2025-59681
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59681
- https://github.com/advisories/GHSA-hpr9-3m2g-3j9p
- https://nvd.nist.gov/vuln/detail/CVE-2025-59681
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/oct/01/security-releases
- https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a
- https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
- http://www.openwall.com/lists/oss-security/2025/10/01/3
- https://github.com/advisories/GHSA-hpr9-3m2g-3j9p
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more