CVE-2025-13372

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. "FilteredRelation" is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the "kwargs" passed to "QuerySet.annotate" or "QuerySet.alias" on PostgreSQL...