CVE-2025-59681: 
Django Análise e mitigação de vulnerabilidades

A SQL injection vulnerability (CVE-2025-59681) was discovered in Django versions 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The vulnerability affects QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods when using MySQL and MariaDB databases. The issue was discovered and reported by security researcher sw0rd1ight, and was publicly disclosed on October 1, 2025 (Django Weblog).

The vulnerability occurs when using a suitably crafted dictionary with dictionary expansion as **kwargs passed to the affected QuerySet methods (annotate(), alias(), aggregate(), and extra()) specifically on MySQL and MariaDB databases. The issue allows SQL injection attacks through column aliases. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) by NIST NVD, indicating the highest severity level (NVD).

If exploited, this vulnerability could allow an attacker to perform SQL injection attacks through column aliases when using the affected QuerySet methods. Given the CVSS score of 9.8, this indicates potential for complete compromise of system confidentiality, integrity, and availability on affected systems using MySQL or MariaDB as their database backend (NVD).

The Django team has released patches for all affected versions: Django 4.2.25, Django 5.1.13, and Django 5.2.7. Users are strongly encouraged to upgrade to these patched versions immediately. The fixes have been applied to Django's main branch, 6.0 (alpha status), 5.2, 5.1, and 4.2 branches (Django Weblog).