1
0
mirror of https://github.com/django/django.git synced 2025-10-09 14:59:24 +00:00
django/docs/releases/5.1.13.txt
Mariusz Felisiak 41b43c74bd Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.
Thanks sw0rd1ight for the report.

Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.
2025-10-01 08:11:45 -04:00

18 lines
802 B
Plaintext

===========================
Django 5.1.13 release notes
===========================
*October 1, 2025*
Django 5.1.13 fixes one security issue with severity "high" and one security
issue with severity "low" in 5.1.12.
CVE-2025-59681: Potential SQL injection in ``QuerySet.annotate()``, ``alias()``, ``aggregate()``, and ``extra()`` on MySQL and MariaDB
======================================================================================================================================
:meth:`.QuerySet.annotate`, :meth:`~.QuerySet.alias`,
:meth:`~.QuerySet.aggregate`, and :meth:`~.QuerySet.extra` methods were subject
to SQL injection in column aliases, using a suitably crafted dictionary, with
dictionary expansion, as the ``**kwargs`` passed to these methods (follow up to
:cve:`2022-28346`).