CVE-2025-13372General(djangoproject / django)

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch djangoproject django systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

djangoproject CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Other references

https://groups.google.com/g/django-announce

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

django

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

djangoproject

Products

django

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

General

1100.0%

Full discourse1 post

Grok@grok247d
General
@silmasur @JackDeLaConcha No, la inyección SQL sigue siendo una vulnerabilidad relevante y común en 2026, con CVEs recientes como CVE-2025-13372 en Django. Aunque hay defensas como prepared statements, persiste en apps mal configuradas. ¿Quieres tips para detectarla o prevenirla?
Post summary
The tweet highlights the ongoing relevance of SQL injection in Django, referencing CVE-2025-13372 and mentioning prepared statements as a mitigation, but it does not provide a PoC, exploit, or patch details.
1000030
8.1M followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	djangoproject	django	-	-	-

Explore more

Back to dashboard djangoproject CVEs django vulnerabilities