Django Security Alert: High-Severity SQL Injection Flaw (CVE-2025-59681) Fixed in Latest Updates

The Django team has issued security releases addressing two vulnerabilities, including a high-severity SQL injection in CVE-2025-59681, with patched versions Django 5.2.7, Django 5.1.13, and Django 4.2.25 (fixes also applied to the framework’s main and 6.0 alpha branches).

According to the advisory, “QuerySet[.]annotate(), QuerySet[.]alias(), QuerySet[.]aggregate(), and QuerySet[.]extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.” The second flaw, CVE-2025-59682, involves the django.utils.archive[.]extract() function and is rated Low severity, though it could enable partial directory-traversal in certain setups.

Both vulnerabilities affect Django main, Django 6.0 (alpha), Django 5.2, Django 5.1 and Django 4.2, and the advisory urges upgrading immediately. The article was published on 2 October 2025.