Django Flaw (CVE-2025-13372) Allows SQL Injection in PostgreSQL FilteredRelation

Django has released a security update for two vulnerabilities, the most critical being CVE-2025-13372, a high-severity SQL injection flaw that affects PostgreSQL environments using the FilteredRelation class. According to the technical details provided, the vulnerability stems from how the framework handles column aliases, with SQL injection possible through crafted dictionary expansion passed to QuerySet[.]annotate() or QuerySet[.]alias() on PostgreSQL.

The flaw was reported by a security researcher named Stackered. In addition, a second vulnerability, CVE-2025-64460, is rated as Moderate and affects the XML serializer, potentially impacting service availability through DoS via specially crafted XML input. The advisory notes that the XML DoS issue results from algorithmic complexity in django.core[.]serializers.xml_serializer.getInnerText(), leading to superlinear computation. Developers are urged to update to patched versions: 5.2.9, 5.1.15, and 4.2.27.