CVE-2025-13372: Django SQL Injection Vulnerability in Column Aliases
Summary
CVE-2025-13372: Django is vulnerable to SQL injection in column aliases. Affects django across 3 version ranges.
>= 4.2a1, < 4.2.27
>= 5.1a1, < 5.1.15
>= 5.2a1, < 5.2.9
Fixed in 4.2.27, 5.1.15 or 5.2.9, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2025-13372 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system that allows developers to interact with databases using Python code. However, certain versions of Django are vulnerable to SQL injection attacks, particularly in the handling of column aliases when using FilteredRelation with dictionary expansion in QuerySet.annotate() or QuerySet.alias() methods on PostgreSQL databases.
Vulnerability Detail
The vulnerability arises from improper handling of user input in column aliases, which can allow an attacker to inject malicious SQL code through crafted dictionaries passed as keyword arguments. This SQL injection vulnerability can lead to unauthorized data access, data manipulation, or even complete database compromise, depending on the attacker's intent and the application's database permissions. The affected versions include Django 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Unsupported versions such as 5.0.x, 4.1.x, and 3.2.x may also be at risk.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2a1, < 4.2.274.2.27pip install --upgrade "django==4.2.27" -
>= 5.1a1, < 5.1.155.1.15pip install --upgrade "django==5.1.15" -
>= 5.2a1, < 5.2.95.2.9pip install --upgrade "django==5.2.9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using FilteredRelation with dictionary expansion in your queries until you can upgrade to a secure version. Instead, consider using alternative methods to achieve the desired query results without exposing your application to SQL injection risks.
Conclusion
The SQL injection vulnerability in Django's handling of column aliases poses a significant risk to applications using affected versions. It is crucial to update to the latest patched versions to protect against potential attacks. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for django →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by allowing an attacker to interfere with the queries that an application makes to its database.
You can check your Django version and compare it with the affected versions listed in the vulnerability details. Additionally, you can use tools like Vulert to monitor and alert for open-source vulnerabilities.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and potentially full control over the database.
Yes, you can temporarily avoid using the vulnerable features, such as FilteredRelation with dictionary expansion, until you can upgrade to a secure version.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock, allowing you to stay informed about potential risks without needing to access the code directly.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
