CVE-2025-57833: A New SQL Injection Flaw Puts Django Web Applications at Risk

CVE-2025-57833 is a high-severity SQL injection flaw in Django that could allow malicious input to manipulate SQL statements through FilteredRelation column aliases, potentially leading to unauthorized data access or full compromise of application databases. The Django Software Foundation has released security updates for multiple supported versions, and the advisory notes that the vulnerability is tracked as CVE-2025-57833 with a CVSS of 7.1.

According to the advisory, affected releases include Django main branch, Django 5.2, Django 5.1 and Django 4.2, with fixed versions issued as Django 5.2.6, Django 5.1.12 and Django 4.2.24. The Django team described the issue as involving SQL injection in column aliases when dictionary expansion is used with **kwargs passed to QuerySet[.]annotate() or QuerySet[.]alias(), particularly in dynamic annotations or aliases in queries.

Security researcher Eyal Gabay (EyalSec) is credited for responsibly disclosing the issue. The anomaly is not a remote code execution flaw, but SQL injection remains a dangerous class of vulnerability frequently exploited in real-world breaches.