PyPI: django
CVE-2025-64459
Safety vulnerability ID: SFTY-20251105-89670
Safety legacy ID: pyup.io-81270
CVE-2025-64459: Affected versions of the Django package are vulnerable to SQL Injection due to improper input validation, allowing the internal _connector keyword argument to be accepted from untrusted dictionaries via expansion. The .filter(), .exclude(), and .get() methods on QuerySet, as well as the Q class, resolve **kwargs and will treat a supplied _connector value as the logical connector without constraining it to the expected set (AND/OR), permitting attacker-controlled tokens to influence SQL predicate construction.
Overview
Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
Advisory
CVE-2025-64459: Affected versions of the Django package are vulnerable to SQL Injection due to improper input validation, allowing the internal _connector keyword argument to be accepted from untrusted dictionaries via expansion. The .filter(), .exclude(), and .get() methods on QuerySet, as well as the Q class, resolve **kwargs and will treat a supplied _connector value as the logical connector without constraining it to the expected set (AND/OR), permitting attacker-controlled tokens to influence SQL predicate construction.
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20251105-89670/CVE-2025-64459
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64459
- https://data.safetycli.com/changelogs/django/
- https://docs.djangoproject.com/en/5.2/releases/4.2.26/
- https://pypi.org/project/django
- https://nvd.nist.gov/vuln/detail/CVE-2025-64459
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases
- https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
- https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
- https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
- https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
- https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
- https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
- https://github.com/advisories/GHSA-frmv-pr5f-9mcr
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more