Django (5.2 < 5.2.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/django-5.2--5.2.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 21:03:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDjango: SQL injection in FilteredRelation (CVE-2025-57833)https://feed.craftedsignal.io/briefs/2026-10-django-sql-injection/Fri, 30 Oct 2026 21:03:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-django-sql-injection/A SQL injection vulnerability in Django allows unauthenticated attackers to execute arbitrary SQL commands via insufficiently validated column aliases in FilteredRelation features.CVE-2025-57833 is a SQL injection vulnerability within the Django framework. The vulnerability exists in the FilteredRelation feature, specifically when using QuerySet.annotate() or QuerySet.alias() methods. Insufficient validation of dictionary keys (column aliases) provided via Python's dictionary expansion allows an attacker to inject arbitrary SQL statements into the database query.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the backend database. This could result in unauthorized data access, modification, or potential privilege escalation within the database environment, depending on the permissions of the database user.

Recommendation

  • Update Django to versions 4.2.24, 5.1.12, 5.2.6, or later to address the insufficient alias validation.
  • Audit applications for usage of dynamic inputs as dictionary keys within annotate() or alias() methods.
  • Implement strict input validation for any user-supplied data used in ORM aliases.
  • Restrict database user permissions to follow the principle of least privilege.
]]>highadvisoryweb-applicationsql-injectioncve