{"action":"Upgrade django to 4.2.27 or later.","affected":[{"fixed":"5.2.9","introduced":"5.2a1"},{"fixed":"5.1.15","introduced":"5.1a1"},{"fixed":"4.2.27","introduced":"4.2a1"}],"component":"django","cve_ids":["CVE-2025-13372"],"ecosystem":"PyPI","epss":0.00923,"exploited":false,"fixed_versions":["5.2.9","5.1.15","4.2.27"],"ghsa_id":"GHSA-rqw2-ghq9-44m7","id":"tcs_01M5KFYFH0HPWP3514BCBCQ2RM","modified_at":"2026-09-10T03:50:58.796518425Z","published_at":"2025-12-02T18:30:35Z","references":["https://osv.dev/vulnerability/GHSA-rqw2-ghq9-44m7","https://nvd.nist.gov/vuln/detail/CVE-2025-13372","https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf","https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0","https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e","https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355","https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/django/django","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-104.yaml","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/dec/02/security-releases"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-rqw2-ghq9-44m7","url":"https://osv.dev/vulnerability/GHSA-rqw2-ghq9-44m7"}],"summary":"Django is vulnerable to SQL injection in column aliases"}