{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/django-4.2--4.2.24/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2025-57833"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Django (4.2 \u003c 4.2.24)","Django (5.1 \u003c 5.1.12)","Django (5.2 \u003c 5.2.6)"],"_cs_severities":["high"],"_cs_tags":["web-application","sql-injection","cve"],"_cs_type":"advisory","_cs_vendors":["Django"],"content_html":"\u003cp\u003eCVE-2025-57833 is a SQL injection vulnerability within the Django framework. The vulnerability exists in the FilteredRelation feature, specifically when using QuerySet.annotate() or QuerySet.alias() methods. Insufficient validation of dictionary keys (column aliases) provided via Python's dictionary expansion allows an attacker to inject arbitrary SQL statements into the database query.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary SQL queries against the backend database. This could result in unauthorized data access, modification, or potential privilege escalation within the database environment, depending on the permissions of the database user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Django to versions 4.2.24, 5.1.12, 5.2.6, or later to address the insufficient alias validation.\u003c/li\u003e\n\u003cli\u003eAudit applications for usage of dynamic inputs as dictionary keys within annotate() or alias() methods.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for any user-supplied data used in ORM aliases.\u003c/li\u003e\n\u003cli\u003eRestrict database user permissions to follow the principle of least privilege.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T21:03:27Z","date_published":"2026-10-30T21:03:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-django-sql-injection/","summary":"A SQL injection vulnerability in Django allows unauthenticated attackers to execute arbitrary SQL commands via insufficiently validated column aliases in FilteredRelation features.","title":"Django: SQL injection in FilteredRelation (CVE-2025-57833)","url":"https://feed.craftedsignal.io/briefs/2026-10-django-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Django (4.2 \u003c 4.2.24)","version":"https://jsonfeed.org/version/1.1"}