Django Web Vulnerability Allows Attackers to Execute SQL Injection

The Django development team has disclosed a high‑severity SQL injection flaw in the FilteredRelation feature, tracked as CVE-2025-57833, which could let attackers inject code by crafting unexpected query parameters. According to Django’s weblog, the issue affects Django main, 5.2, 5.1, and 4.2, and users should upgrade immediately to protect their applications.

The vulnerability stems from FilteredRelation not validating dictionary keys properly when used with QuerySet[.]annotate() or QuerySet[.]alias(), allowing a malicious dictionary to alter how column aliases are built. Patches have been applied across the main branch and the maintained release branches, with fixed releases listed as 5.2.6, 5.1.12, and 4.2.24. The Django GitHub repository hosts the patches and commits for review, and developers are urged to run their test suites before deploying to production. Stay secure by upgrading to Django 5.2.6, 5.1.12, or 4.2.24 to mitigate SQL injection risks.