CVE-2025-57833: Django SQL Injection Vulnerability in Column Aliases
Summary
CVE-2025-57833: Django is subject to SQL injection through its column aliases. Affects django across 3 version ranges.
< 4.2.24
>= 5.0a1, < 5.1.12
>= 5.2a1, < 5.2.6
Fixed in 4.2.24, 5.1.12 or 5.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2025-57833 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system that simplifies database interactions. However, certain versions of Django are vulnerable to SQL injection attacks through its column aliases, specifically when using the FilteredRelation feature.
Vulnerability Detail
An issue was discovered in Django versions 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. The vulnerability arises from the FilteredRelation being susceptible to SQL injection in column aliases. This occurs when a crafted dictionary is passed to the QuerySet.annotate() or QuerySet.alias() methods, allowing an attacker to manipulate SQL queries and potentially access sensitive data. The ramifications of this vulnerability can be severe, leading to unauthorized data exposure and compromise of the application's integrity.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.244.2.24pip install --upgrade "django==4.2.24" -
>= 5.0a1, < 5.1.125.1.12pip install --upgrade "django==5.1.12" -
>= 5.2a1, < 5.2.65.2.6pip install --upgrade "django==5.2.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using FilteredRelation with column aliases until you can update to a secure version. Review your code to ensure that any dynamic SQL generation does not expose your application to SQL injection risks.
Conclusion
In summary, CVE-2025-57833 poses a significant SQL injection risk in certain versions of Django. It is crucial for developers to update to the patched versions to protect their applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for django →
FAQ
CVE-2025-57833 is a vulnerability in Django that allows SQL injection through its column aliases, affecting specific versions of the framework.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Pipfile.lock.
Django versions 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6 are vulnerable to this SQL injection issue.
The consequences can include unauthorized access to sensitive data, data corruption, and potential compromise of the entire application.
You can update Django by running 'pip install --upgrade django==<version>' in your terminal, replacing <version> with the appropriate patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
