SQL Injection Vulnerability in Django Framework
CVE-2025-59681
7.1HIGH
What is CVE-2025-59681?
A vulnerability in the Django framework allows for SQL injection through the use of certain methods such as QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra(). This issue arises when unvalidated user input is passed in a crafted dictionary as **kwargs, potentially enabling attackers to manipulate SQL queries on MySQL and MariaDB databases. System administrators and developers are encouraged to update to the latest Django versions to mitigate this risk.
Affected Version(s)
Django 4.2 < 4.2.25
Django 5.1 < 5.1.13
Django 5.2 < 5.2.7