mirror of
https://github.com/django/django.git
synced 2025-10-09 14:59:24 +00:00
4c044fcc86
Thanks Eyal Gabay (EyalSec) for the report. Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.
15 lines
559 B
Plaintext
15 lines
559 B
Plaintext
===========================
|
|
Django 4.2.24 release notes
|
|
===========================
|
|
|
|
*September 3, 2025*
|
|
|
|
Django 4.2.24 fixes a security issue with severity "high" in 4.2.23.
|
|
|
|
CVE-2025-57833: Potential SQL injection in ``FilteredRelation`` column aliases
|
|
==============================================================================
|
|
|
|
:class:`.FilteredRelation` was subject to SQL injection in column aliases,
|
|
using a suitably crafted dictionary, with dictionary expansion, as the
|
|
``**kwargs`` passed to :meth:`.QuerySet.annotate` or :meth:`.QuerySet.alias`.
|