PyPI/django CVE-2025-13372: medium 4.3, EPSS 0.92%

Django is vulnerable to SQL injection in column aliases

Action: Upgrade django to 4.2.27 or later.

pip install django==5.2.9

pip install django==5.1.15

pip install django==4.2.27

Affected

Fixed versions

Sources

• osv: GHSA-rqw2-ghq9-44m7
• https://nvd.nist.gov/vuln/detail/CVE-2025-13372
• https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf
• https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0
• https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e
• https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355
• https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-104.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/dec/02/security-releases

CVE-2025-13372 · published 2025-12-02T18:30:35Z · modified 2026-09-10T03:50:58.796518425Z · JSON