GHSA-frmv-pr5f-9mcr
Critical · 9.1CVSS
9.1
EPSS
—
Published
Nov 5, 2025
CISA due date
—
The record
Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | django | 0 | 4.2.26 |
| PyPI | django | 5.0a1 | 5.1.14 |
| PyPI | django | 5.2a1 | 5.2.8 |
| Bitnami | django | 4.2.0 | 4.2.26 |
| pypi | Django | 5.0a1 | No fix |
| pypi | Django | 5.2a1 | No fix |
Related vulnerabilities
- CVE-2025-64459 Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q… Same vulnerability
- GHSA-8p8v-wh79-9r56 Django vulnerable to Uncontrolled Resource Consumption Also affects django
- GHSA-mjgh-79qc-68w3 Django has a Race Condition vulnerability Also affects django
- CVE-2026-25673 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Also affects django
- CVE-2026-25674 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Also affects django
- GHSA-6426-9fv3-65x8 Django has an SQL Injection issue Also affects django
- GHSA-gvg8-93h5-g6qq Django has an SQL Injection issue Also affects django
- GHSA-2mcm-79hx-8fxw Django has Observable Timing Discrepancy Also affects django