CVE-2025-59681: Django SQL Injection Vulnerability

CVE-2025-59681 Overview

A SQL injection vulnerability has been discovered in Django, one of the most widely used Python web frameworks. This vulnerability affects the QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods, allowing attackers to inject malicious SQL code through column aliases when using dictionary expansion with specially crafted dictionaries as **kwargs. The vulnerability specifically impacts applications running on MySQL and MariaDB database backends.

Critical Impact

Attackers can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, data modification, or complete database compromise on affected Django applications using MySQL or MariaDB.

Affected Products

• Django 4.2 before 4.2.25
• Django 5.1 before 5.1.13
• Django 5.2 before 5.2.7

Discovery Timeline

• October 1, 2025 - CVE-2025-59681 published to NVD
• October 1, 2025 - Django Project releases security patches
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-59681

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in Django's ORM layer, specifically within methods that accept column aliases as keyword arguments. When developers use dictionary expansion (**kwargs) to pass dynamically constructed dictionaries to QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), or QuerySet.extra(), an attacker who can control the dictionary keys can inject malicious SQL through these column alias names.

The vulnerability is particularly dangerous because column aliases are typically not considered user-controllable input, and many applications may pass user-influenced data through these methods without proper sanitization. The issue is limited to MySQL and MariaDB backends due to differences in how these databases handle identifier quoting compared to other database systems like PostgreSQL.

Root Cause

The root cause stems from insufficient sanitization of column alias names when constructing SQL queries. Django's ORM typically escapes values to prevent SQL injection, but the alias names (which become column identifiers in the generated SQL) were not being properly validated or escaped when using dictionary expansion. On MySQL and MariaDB, attackers can craft dictionary keys containing SQL metacharacters that break out of the expected identifier context and inject arbitrary SQL statements.

Attack Vector

This vulnerability is exploitable over the network without authentication or user interaction. An attacker would need to find an application endpoint where:

1. User input influences the keys of a dictionary passed to one of the vulnerable QuerySet methods
2. The dictionary is expanded using **kwargs syntax
3. The application uses MySQL or MariaDB as its database backend

The vulnerability mechanism involves crafting dictionary keys with SQL injection payloads that, when used as column aliases, allow the attacker to modify the query structure. Because the alias appears in the SELECT clause of the generated SQL, successful exploitation could allow attackers to extract sensitive data from other tables, modify database records, or execute administrative operations depending on database permissions. See the Django Weblog Security Releases for additional technical details.

Detection Methods for CVE-2025-59681

Indicators of Compromise

• Unusual SQL error messages in application logs indicating malformed queries or unexpected column aliases
• Database query logs showing queries with suspicious column alias names containing SQL keywords or special characters
• Unexpected data access patterns in database audit logs
• Application errors related to QuerySet methods with dictionary expansion

Detection Strategies

• Monitor web application logs for requests containing SQL metacharacters in parameters that may influence QuerySet method arguments
• Implement database query logging and alerting for queries with unusual column alias patterns
• Deploy web application firewalls (WAF) with rules to detect SQL injection attempts in request parameters
• Review application code for usages of annotate(), alias(), aggregate(), and extra() with dictionary expansion from user-controllable sources

Monitoring Recommendations

• Enable detailed query logging on MySQL/MariaDB databases to capture column alias information
• Configure intrusion detection systems to alert on SQL injection signature patterns
• Monitor Django application error rates for increases that may indicate exploitation attempts
• Implement runtime application self-protection (RASP) to detect SQL injection attempts at the application layer

How to Mitigate CVE-2025-59681

Immediate Actions Required

• Upgrade Django to patched versions: 4.2.25, 5.1.13, or 5.2.7 or later
• Review application code for vulnerable patterns using QuerySet methods with dictionary expansion from user input
• Implement input validation to ensure dictionary keys used in QuerySet methods contain only safe characters
• Consider temporarily switching to PostgreSQL if immediate patching is not possible

Patch Information

The Django Project has released security patches addressing this vulnerability. Updated versions are available:

• Django 4.2.25 for the 4.2.x LTS branch
• Django 5.1.13 for the 5.1.x branch
• Django 5.2.7 for the 5.2.x branch

Patches are available through the official Django releases. For more information, refer to the Django Security Release Notes and the Django Weblog Security Releases.

Workarounds

• Avoid using dictionary expansion (**kwargs) with user-controllable data in QuerySet methods until patching is complete
• Implement strict allowlisting of acceptable column alias names before passing to QuerySet methods
• Use static, hardcoded column aliases rather than dynamically generated ones from user input
• Add application-level validation to reject dictionary keys containing SQL metacharacters

# Upgrade Django to patched version
pip install --upgrade Django>=4.2.25  # For Django 4.2.x
pip install --upgrade Django>=5.1.13  # For Django 5.1.x
pip install --upgrade Django>=5.2.7   # For Django 5.2.x

# Verify installed version
python -c "import django; print(django.get_version())"