Skip to content
Threat Feed
Subscribe
high advisory

Django: SQL injection in FilteredRelation (CVE-2025-57833)

A SQL injection vulnerability in Django allows unauthenticated attackers to execute arbitrary SQL commands via insufficiently validated column aliases in FilteredRelation features.

CVE search metadata

CVE search record: CVE-2025-57833. Severity: high. CVSS: 7.1. EPSS: 26.11%. KEV: no. Product: Django (4.2 < 4.2.24), Django (5.1 < 5.1.12), Django (5.2 < 5.2.6). Brief: Django: SQL injection in FilteredRelation (CVE-2025-57833). Brief link: https://feed.craftedsignal.io/briefs/2026-10-django-sql-injection/

Triage facts

Revision 1
Applicability
Django (4.2 < 4.2.24), Django (5.1 < 5.1.12) +1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Oct 30, 21:03 UTC
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2025-57833 is a SQL injection vulnerability within the Django framework. The vulnerability exists in the FilteredRelation feature, specifically when using QuerySet.annotate() or QuerySet.alias() methods. Insufficient validation of dictionary keys (column aliases) provided via Python's dictionary expansion allows an attacker to inject arbitrary SQL statements into the database query.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the backend database. This could result in unauthorized data access, modification, or potential privilege escalation within the database environment, depending on the permissions of the database user.

Recommendation

  • Update Django to versions 4.2.24, 5.1.12, 5.2.6, or later to address the insufficient alias validation.
  • Audit applications for usage of dynamic inputs as dictionary keys within annotate() or alias() methods.
  • Implement strict input validation for any user-supplied data used in ORM aliases.
  • Restrict database user permissions to follow the principle of least privilege.

Immediate actions

Patch Django to 4.2.24 or later

IT Operations 48h

Threat Hunt

Identify HTTP POST requests to application endpoints that contain unusual or semicolon-terminated strings in JSON parameters mapped to query aliases

T1190 high high confidence hunt now

Data: Web server logs (access logs), Application request payload logs

Mitigations

Upgrade Django to 4.2.24, 5.1.12, or 5.2.6

immediate IT Operations

CVE-2025-57833