Skip to content
OpenAdvisories
Critical USN-7859-1 1 CVE

python-django vulnerabilities

Published Nov 5, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Django incorrectly handled certain characters in
queries. An attacker could possibly use this issue to execute arbitrary SQL
commands.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.23
Ubuntu · 24.04 LTS 24.04:LTS python-django 3:4.2.11-1ubuntu1.12
Ubuntu · 25.10 python-django 3:5.2.4-1ubuntu2.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-django 2:2.2.12-1ubuntu0.29+esm5

Vulnerabilities 1

  • Critical 9.1
    CVE-2025-64459 Public exploit EPSS 19%

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-64459