CVE-2025-13372

score

<0.1

cvss

4.3

epss

0.9%

published

2025-12-02

kev added

—

first seen

2026-10-21

Django < 5.2.9, < 5.1.15, and < 4.2.27 contains a SQL injection caused by improper sanitization of column aliases in FilteredRelation via dictionary expansion in QuerySet.annotate() or QuerySet.alias() on PostgreSQL, letting attackers execute arbitrary SQL commands, exploit requires crafted dictionary input.