CVE-2025-57833

Published Sep 3, 2025

Last updated 5 days ago

Django

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-57833 is a security vulnerability affecting Django versions 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. It involves a potential SQL injection flaw within the FilteredRelation component of Django's Object-Relational Mapping (ORM) system. The vulnerability can be exploited by passing a specially crafted dictionary as a keyword argument to the QuerySet.annotate() or QuerySet.alias() methods, which could lead to the injection of malicious SQL code. This could allow an attacker to interfere with the queries that an application makes to its database, potentially leading to unauthorized data access or modification.

Description: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.1
Impact score: 4.7
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-89

Hype score: Not currently trending

References