GHSA-rqw2-ghq9-44m7
Medium · 4.3CVSS
4.3
EPSS
—
Published
Dec 2, 2025
CISA due date
—
The record
Django is vulnerable to SQL injection in column aliases
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | django | 4.2a1 | 4.2.27 |
| PyPI | django | 5.1a1 | 5.1.15 |
| PyPI | django | 5.2a1 | 5.2.9 |
| Bitnami | django | 4.2.0 | 4.2.27 |
| Chainguard | authentik | 0 | 2025.10.2-r2 |
| Chainguard | authentik-go-server | 0 | 2025.10.2-r2 |
| Chainguard | awx | 0 | 24.6.1-r20 |
| pypi | Django | 4.2a1 | No fix |
| pypi | Django | 5.1a1 | No fix |
| pypi | Django | 5.2a1 | No fix |
Related vulnerabilities
- CVE-2025-13372 Django is vulnerable to SQL injection in column aliases Same vulnerability
- GHSA-8p8v-wh79-9r56 Django vulnerable to Uncontrolled Resource Consumption Also affects django
- GHSA-mjgh-79qc-68w3 Django has a Race Condition vulnerability Also affects django
- CVE-2026-25673 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Also affects django
- CVE-2026-25674 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Also affects django
- GHSA-6426-9fv3-65x8 Django has an SQL Injection issue Also affects django
- GHSA-gvg8-93h5-g6qq Django has an SQL Injection issue Also affects django
- GHSA-2mcm-79hx-8fxw Django has Observable Timing Discrepancy Also affects django