Django vulnerable to SQL injection in column aliases

🗓️ 01 Oct 2025 21:31:21Reported by GitHub Advisory DatabaseType

Django SQL injection risk in column aliases via expanded dictionaries on MySQL and MariaDB.

Reporter	Title	Published	Views	Family All 113
FreeBSD	Django -- multiple vulnerabilities	1 Oct 202500:00	–	freebsd
AlpineLinux	CVE-2025-59681	1 Oct 202500:00	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in Python-Django	14 Sep 202612:01	–	astralinux
BDU FSTEC	Django QuerySet annotate alias aggregate extra	3 Oct 202500:00	–	bdu_fstec
Chainguard	CVE-2025-59681 vulnerabilities	3 Oct 202513:45	–	cgr
Circl	CVE-2025-59681	1 Oct 202516:25	–	circl
CNNVD	Django SQL injection vulnerability	1 Oct 202500:00	–	cnnvd
CVE	CVE-2025-59681	1 Oct 202500:00	–	cve
Cvelist	CVE-2025-59681	1 Oct 202500:00	–	cvelist
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses django-4.2.24-py3-none-any.whl which is vulnerable to CVE-2025-59681, CVE-2025-59682.	9 Dec 202514:05	–	ibm

Vulners

Node

django_project djangoRange5.1–5.1.13pip

django_project djangoRange4.2–4.2.25pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-59681
docs	www.docs.djangoproject.com/en/dev/releases/security
groups	www.groups.google.com/g/django-announce
djangoproject	www.djangoproject.com/weblog/2025/oct/01/security-releases
github	www.github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a
github	www.github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
openwall	www.openwall.com/lists/oss-security/2025/10/01/3
github	www.github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-106.yaml
github	www.github.com/advisories/GHSA-hpr9-3m2g-3j9p

05 Jun 2026 14:33Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.1 - 9.8

EPSS0.00639

SSVC