Skip to content
OpenAdvisories
High USN-7736-1 1 CVE

python-django vulnerability

Published Sep 3, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Django incorrectly handled certain inputs.
An attacker could possibly use this issue to perform a SQL injection.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.21
Ubuntu · 24.04 LTS 24.04:LTS python-django 3:4.2.11-1ubuntu1.10
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-django 2:2.2.12-1ubuntu0.29+esm3

Vulnerabilities 1

  • High 7.1
    CVE-2025-57833 Public exploit EPSS 28%

    Django is subject to SQL injection through its column aliases

    An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annot…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-57833