{"id":"CVE-2025-57833","aliases":["ALPINE-CVE-2025-57833","BIT-django-2025-57833","CLSA-2025-1759882283","CLSA-2026-1787142559","CLSA-2026-1788437106","CLSA-2026-1788862060","CLSA-2026-1788934711","CLSA-2026-1789117629","CLSA-2026-1789455474","CLSA-2026-1789475134","CLSA-2026-1790339542","CLSA-2026-1790830085","CLSA-2026-1790830102","DEBIAN-CVE-2025-57833","DLA-4301-1","DSA-6117-1","DSA-6136-1","EUVD-2025-26641","GHSA-6w2r-r2m5-xq5w","MGASA-2025-0229","OESA-2025-2231","OESA-2025-2234","OESA-2025-2235","OESA-2025-2236","OESA-2025-2237","OESA-2025-2354","PYSEC-2025-105","RHSA-2025:16403","RHSA-2025:16487","RHSA-2025:17498","RHSA-2025:17499","RHSA-2025:17500","RHSA-2025:17606","RHSA-2025:17613","RHSA-2025:17614","ROOT-APP-PYPI-CVE-2025-57833","SUSE-SU-2025:03074-1","UBUNTU-CVE-2025-57833","USN-7736-1","openSUSE-SU-2025:15527-1","openSUSE-SU-2025:15528-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Django is subject to SQL injection through its column aliases","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.28271,"percentile":0.98145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2025-03-09T13:00:00Z","modified":"2026-11-03T06:33:00Z","exploits":[{"source":"pocgithub","id":"Mkway/CVE-2025-57833","title":"Mkway/CVE-2025-57833","date":"2025-09-05","url":"https://github.com/Mkway/CVE-2025-57833"},{"source":"pocgithub","id":"loic-houchi/Django-faille-CVE-2025-57833_test","title":"loic-houchi/Django-faille-CVE-2025-57833_test","date":"2025-09-09","url":"https://github.com/loic-houchi/Django-faille-CVE-2025-57833_test"},{"source":"pocgithub","id":"ianoboyle/CVE-2025-57833","title":"ianoboyle/CVE-2025-57833","date":"2025-10-08","url":"https://github.com/ianoboyle/CVE-2025-57833"},{"source":"pocgithub","id":"sw0rd1ight/CVE-2025-57833","title":"sw0rd1ight/CVE-2025-57833","date":"2025-11-02","url":"https://github.com/sw0rd1ight/CVE-2025-57833"},{"source":"pocgithub","id":"Gayang2902/CVE-2025-57833","title":"Gayang2902/CVE-2025-57833","date":"2025-11-27","url":"https://github.com/Gayang2902/CVE-2025-57833"}],"fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["4.2.24","5.1.12","5.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["4.2.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["4.2.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["4.2.24-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["4.2.24","5.1.12","5.2.6"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"django","fixed_in":["3.2.25.post3+tuxcare","5.1.10.post4+tuxcare","5.1.post9+tuxcare","4.0.post21+tuxcare","5.0.2.post10+tuxcare","5.0.1.post11+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["3:3.2.25-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["3:4.2.27-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:4.2.24-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"python-django","fixed_in":["2:2.2.28-1~deb11u8"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-django","fixed_in":["4.1.13-1.6.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","fixed_in":["4.2.15-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-django","fixed_in":["4.2.15-8.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-django","fixed_in":["4.2.15-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-django","fixed_in":["4.2.15-8.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-django","fixed_in":["4.2.15-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-django","fixed_in":["2.2.27-18.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","fixed_in":["0:4.2.24-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","fixed_in":["0:4.2.24-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","fixed_in":["0:4.2.24-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","fixed_in":["0:4.2.24-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python-django","fixed_in":["0:2.2.24-12.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-django","fixed_in":["0:2.2.24-12.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python-django20","fixed_in":["0:2.0.13-20.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-django20","fixed_in":["0:2.0.13-20.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:18.0::el9","package":"python-django","fixed_in":["0:3.2.12-9.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:18.0::el9","package":"python3-django","fixed_in":["0:3.2.12-9.el9ost"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"django","fixed_in":["4.1.13+aikido.2","3.2.25+aikido.1","4.1.13+aikido.3","2.2.28+aikido.2","3.2.25+aikido.2","2.2.28+aikido.3","3.2.25+aikido.3","4.1.13+aikido.4","2.2.28+aikido.4","4.1.13+aikido.5","2.2.28+aikido.5","3.2.25+aikido.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-Django","fixed_in":["4.2.11-150600.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-Django","fixed_in":["4.2.11-150600.3.30.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-Django","fixed_in":["4.2.11-150600.3.30.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","fixed_in":["2:2.2.12-1ubuntu0.29+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-django","fixed_in":["2:3.2.12-2ubuntu1.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-django","fixed_in":["3:4.2.11-1ubuntu1.10"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Django","fixed_in":["5.2.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","fixed_in":["4.2.24-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0a1"},{"fixed":"5.1.12"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2a1"},{"fixed":"5.2.6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.24"},{"introduced":"5.0.0"},{"fixed":"5.1.12"},{"introduced":"5.2.0"},{"fixed":"5.2.6"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.25"},{"fixed":"3.2.25.post3+tuxcare"}]}],"versions":["3.2.25","3.2.25.post1+tuxcare","3.2.25.post2+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9"},{"fixed":"5.1.9.post5+tuxcare"}]}],"versions":["5.1.9","5.1.9.post1+tuxcare","5.1.9.post2+tuxcare","5.1.9.post3+tuxcare","5.1.9.post4+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.10"},{"fixed":"5.1.10.post4+tuxcare"}]}],"versions":["5.1.10","5.1.10.post1+tuxcare","5.1.10.post2+tuxcare","5.1.10.post3+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4"},{"fixed":"5.1.4.post6+tuxcare"}]}],"versions":["5.1.4","5.1.4.post1+tuxcare","5.1.4.post2+tuxcare","5.1.4.post3+tuxcare","5.1.4.post4+tuxcare","5.1.4.post5+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post12+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post10+tuxcare","4.2.post11+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare","4.2.post6+tuxcare","4.2.post7+tuxcare","4.2.post8+tuxcare","4.2.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.post12+tuxcare"}]}],"versions":["5.0","5.0.post1+tuxcare","5.0.post10+tuxcare","5.0.post11+tuxcare","5.0.post2+tuxcare","5.0.post3+tuxcare","5.0.post4+tuxcare","5.0.post5+tuxcare","5.0.post6+tuxcare","5.0.post7+tuxcare","5.0.post8+tuxcare","5.0.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.post9+tuxcare"}]}],"versions":["5.1","5.1.post1+tuxcare","5.1.post2+tuxcare","5.1.post3+tuxcare","5.1.post4+tuxcare","5.1.post5+tuxcare","5.1.post6+tuxcare","5.1.post7+tuxcare","5.1.post8+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.post21+tuxcare"}]}],"versions":["4.0","4.0.post1+tuxcare","4.0.post10+tuxcare","4.0.post11+tuxcare","4.0.post12+tuxcare","4.0.post13+tuxcare","4.0.post14+tuxcare","4.0.post15+tuxcare","4.0.post16+tuxcare","4.0.post17+tuxcare","4.0.post18+tuxcare","4.0.post19+tuxcare","4.0.post2+tuxcare","4.0.post20+tuxcare","4.0.post3+tuxcare","4.0.post4+tuxcare","4.0.post5+tuxcare","4.0.post6+tuxcare","4.0.post7+tuxcare","4.0.post8+tuxcare","4.0.post9+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2"},{"fixed":"5.0.2.post10+tuxcare"}]}],"versions":["5.0.2","5.0.2.post1+tuxcare","5.0.2.post2+tuxcare","5.0.2.post3+tuxcare","5.0.2.post4+tuxcare","5.0.2.post5+tuxcare","5.0.2.post6+tuxcare","5.0.2.post7+tuxcare","5.0.2.post8+tuxcare","5.0.2.post9+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.1"},{"fixed":"5.0.1.post11+tuxcare"}]}],"versions":["5.0.1","5.0.1.post1+tuxcare","5.0.1.post10+tuxcare","5.0.1.post2+tuxcare","5.0.1.post3+tuxcare","5.0.1.post4+tuxcare","5.0.1.post5+tuxcare","5.0.1.post6+tuxcare","5.0.1.post7+tuxcare","5.0.1.post8+tuxcare","5.0.1.post9+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u1"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.27-0+deb13u1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.24-1"}]}],"versions":["3:4.2.23-1"]},{"source":"osv","ecosystem":"Debian:11","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.28-1~deb11u8"}]}],"versions":["2:2.2.24-1","2:2.2.25-1~deb11u1","2:2.2.26-1~deb11u1","2:2.2.28-1~deb11u1","2:2.2.28-1~deb11u2","2:2.2.28-1~deb11u3","2:2.2.28-1~deb11u4","2:2.2.28-1~deb11u5","2:2.2.28-1~deb11u6","2:2.2.28-1~deb11u7"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.27-0+deb13u1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u1"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1"],"bundled":23},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.10","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10a1","1.10b1","1.10rc1","1.11","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.2","1.11.20","1.11.21","1.11.22","1.11.23","1.11.24","1.11.25","1.11.26","1.11.27","1.11.28","1.11.29","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11a1","1.11b1","1.11rc1","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1","1.9","1.9.1","1.9.10","1.9.11","1.9.12","1.9.13","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9a1","1.9b1","1.9rc1","1.9rc2","2.0","2.0.1","2.0.10","2.0.12","2.0.13","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0a1","2.0b1","2.0rc1","2.1","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9","2.1a1","2.1b1","2.1rc1","2.2","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.23","2.2.24","2.2.25","2.2.26","2.2.27","2.2.28","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.2a1","2.2b1","2.2rc1","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.0a1","3.0b1","3.0rc1","3.1","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.1a1","3.1b1","3.1rc1","3.2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.15","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.20","3.2.21","3.2.22","3.2.23","3.2.24","3.2.25","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.2a1","3.2b1","3.2rc1","4.0","4.0.1","4.0.10","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.0a1","4.0b1","4.0rc1","4.1","4.1.1","4.1.10","4.1.11","4.1.12","4.1.13","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.1a1","4.1b1","4.1rc1","4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.2a1","4.2b1","4.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0a1"},{"fixed":"5.1.12"}]}],"versions":["5.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.0a1","5.0b1","5.0rc1","5.1","5.1.1","5.1.10","5.1.11","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.1a1","5.1b1","5.1rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2a1"},{"fixed":"5.2.6"}]}],"versions":["5.2","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2a1","5.2b1","5.2rc1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13-1.6.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-8.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-8.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-18.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.24"},{"introduced":"5.1"},{"fixed":"5.1.12"},{"introduced":"5.2"},{"fixed":"5.2.6"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","5.1","5.1.1","5.1.10","5.1.11","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.2","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.20-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.20-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-12.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-12.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-django20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-20.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-django20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-20.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:18.0::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.12-9.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:18.0::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.12-9.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.34.0-4.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.34.0-4.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13+aikido.2"},{"fixed":"3.2.25+aikido.1"},{"fixed":"4.1.13+aikido.3"},{"fixed":"2.2.28+aikido.2"},{"fixed":"3.2.25+aikido.2"},{"fixed":"2.2.28+aikido.3"},{"fixed":"3.2.25+aikido.3"},{"fixed":"4.1.13+aikido.4"},{"fixed":"2.2.28+aikido.4"},{"fixed":"4.1.13+aikido.5"},{"fixed":"2.2.28+aikido.5"},{"fixed":"3.2.25+aikido.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.30.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.30.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm3"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.21"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.10"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm3"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.21"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.10"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://groups.google.com/g/django-announce","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://www.djangoproject.com/weblog/2025/sep/03/security-releases/","tags":["Vendor Advisory","advisory","article"]},{"url":"https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898","tags":["Exploit","Third Party Advisory","advisory","web","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/03/3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57833","tags":["web","advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2025/sep/03/security-releases","tags":["web"]},{"url":"https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5","tags":["web"]},{"url":"https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92","tags":["web"]},{"url":"https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6w2r-r2m5-xq5w","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-57833","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57833.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-57833","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0229.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34612","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/09/03/3","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2231","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2234","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2235","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2236","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2237","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2354","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16403","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392990","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16403.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-57833","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-57833","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16487","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370365","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16487.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48432","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/04/5","tags":["article"]},{"url":"https://www.djangoproject.com/weblog/2025/jun/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17498","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17498.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17499","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17499.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17500","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17500.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17606","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.17/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2398216","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-38394","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38396","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38397","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38398","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38496","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38730","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17606.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10990","tags":["advisory"]},{"url":"https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f","tags":["article"]},{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m","tags":["article"]},{"url":"https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-57052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-57052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57052","tags":["advisory"]},{"url":"https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17613","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-38406","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38408","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38410","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38411","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17613.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17614","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17614.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-49761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2322153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49761","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503074-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248810","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-57833","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7736-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-03T00:00:00Z","modified":"2025-11-04T21:13:19.662Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-26641","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-03T00:00:00Z","modified":"2025-11-04T21:13:19Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"ghsa":[{"id":"GHSA-6w2r-r2m5-xq5w","title":"Django is subject to SQL injection through its column aliases","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-08T18:31:31Z","modified":"2026-06-05T14:33:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-03T21:15:32.85Z","modified":"2026-06-17T09:43:30.48Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:27.145738Z"}],"osv":[{"id":"ALPINE-CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-03T21:15:32.85Z","modified":"2026-11-03T06:33:00.798651873Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-03T00:00:00Z","modified":"2026-10-28T02:30:46.846171159Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"DEBIAN-CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-03T21:15:32.85Z","modified":"2026-09-01T20:05:54.51957984Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-6w2r-r2m5-xq5w","title":"Django is subject to SQL injection through its column aliases","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-08T18:31:31Z","modified":"2026-09-10T03:50:27.987884944Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"OESA-2025-2231","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)","status":"published","published":"2025-09-05T11:09:18Z","modified":"2026-08-18T01:18:11.11603548Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2234","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)","status":"published","published":"2025-09-12T11:09:18Z","modified":"2026-08-18T01:18:11.196279302Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2235","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)","status":"published","published":"2025-09-12T11:09:18Z","modified":"2026-08-18T01:18:11.244250131Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2236","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)","status":"published","published":"2025-09-12T11:09:18Z","modified":"2026-08-18T01:18:11.370982872Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2237","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)","status":"published","published":"2025-09-12T11:09:18Z","modified":"2026-08-18T01:18:11.220887647Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2354","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)","status":"published","published":"2025-09-26T11:09:26Z","modified":"2026-08-18T01:19:11.706108646Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2025-105","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-03T21:15:32.85Z","modified":"2026-06-10T17:01:10.893593582Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"RHSA-2025:16403","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2025-09-23T10:04:41Z","modified":"2026-06-29T11:13:01Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16487","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2025-09-24T10:05:55Z","modified":"2026-06-29T11:13:10Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17498","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-django) security update","status":"published","published":"2025-10-08T10:04:35Z","modified":"2026-06-29T11:14:29Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17499","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-django20) security update","status":"published","published":"2025-10-08T10:04:35Z","modified":"2026-06-29T11:14:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17500","title":"Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-django) security update","status":"published","published":"2025-10-08T10:04:36Z","modified":"2026-06-29T11:14:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17606","title":"Red Hat Security Advisory: Satellite 6.17.5 Async Update","status":"published","published":"2025-10-09T10:20:50Z","modified":"2026-06-29T11:14:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17613","title":"Red Hat Security Advisory: Satellite 6.16.5.4 Async Update","status":"published","published":"2025-10-09T10:20:51Z","modified":"2026-06-29T11:14:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17614","title":"Red Hat Security Advisory: Satellite 6.15.5.5 Async Update","status":"published","published":"2025-10-09T10:20:52Z","modified":"2026-06-30T10:19:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"UBUNTU-CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-03-09T13:00:00Z","modified":"2026-02-04T03:10:34.854394Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"BIT-django-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().","status":"published","published":"2025-09-25T08:40:38.586Z","modified":"2026-09-10T16:01:31.335597821Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2025-1759882283","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post1+tuxcare.","status":"withdrawn","published":"2026-08-04T14:52:08Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1787142559","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post3+tuxcare.","status":"published","published":"2026-08-19T12:29:19Z","modified":"2026-10-15T09:48:05.625790821Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788437106","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post5+tuxcare.","status":"published","published":"2026-09-03T12:05:06Z","modified":"2026-10-15T09:48:01.354907557Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788862060","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.10.post4+tuxcare.","status":"published","published":"2026-09-08T10:07:40Z","modified":"2026-10-15T09:48:01.310283636Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788934711","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post6+tuxcare.","status":"published","published":"2026-09-09T06:18:31Z","modified":"2026-10-15T09:48:01.716688916Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789117629","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 4.2.post12+tuxcare.","status":"published","published":"2026-09-11T09:07:09Z","modified":"2026-10-15T09:48:01.351725103Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789455474","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post12+tuxcare.","status":"published","published":"2026-09-15T06:57:54Z","modified":"2026-10-15T09:48:01.870094799Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789475134","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.post9+tuxcare.","status":"published","published":"2026-09-15T12:25:34Z","modified":"2026-10-15T09:48:02.019078142Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790339542","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post21+tuxcare.","status":"published","published":"2026-09-25T12:32:22Z","modified":"2026-10-15T09:48:02.211328271Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790830085","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.2.post10+tuxcare.","status":"published","published":"2026-10-01T04:48:05Z","modified":"2026-10-15T09:48:02.26217279Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790830102","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.1.post11+tuxcare.","status":"published","published":"2026-10-01T04:48:22Z","modified":"2026-10-15T09:48:02.31456292Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"DLA-4301-1","title":"python-django - security update","status":"published","published":"2025-09-15T00:00:00Z","modified":"2026-03-09T02:08:41.529826Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6117-1","title":"python-django - security update","status":"published","published":"2026-01-31T00:00:00Z","modified":"2026-01-31T13:30:09.574225Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6136-1","title":"python-django - security update","status":"published","published":"2026-02-15T00:00:00Z","modified":"2026-02-15T22:15:22.938868Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0229","title":"Updated python-django packages fix security vulnerability","description":"Potential SQL injection in FilteredRelation column aliases.\n(CVE-2025-57833)\n","status":"published","published":"2025-09-08T19:35:43Z","modified":"2026-04-16T04:42:38.624239064Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15527-1","title":"python311-Django-5.2.6-1.1 on GA media","description":"These are all security issues fixed in the python311-Django-5.2.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-05T00:00:00Z","modified":"2026-03-23T04:53:53.628459Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15528-1","title":"python311-Django4-4.2.24-1.1 on GA media","description":"These are all security issues fixed in the python311-Django4-4.2.24-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-05T00:00:00Z","modified":"2026-03-23T04:53:53.757471Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-APP-PYPI-CVE-2025-57833","title":"CVE-2025-57833 in django - Patched by Root","description":"Root has patched CVE-2025-57833 in the django package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-13T08:41:15Z","modified":"2026-10-13T09:00:03.958920485Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-SU-2025:03074-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2025-57833: Fixed potential SQL injection in FilteredRelation column aliases (bsc#1248810)\n","status":"published","published":"2025-09-04T10:46:20Z","modified":"2026-03-23T04:49:53.420586Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"USN-7736-1","title":"python-django vulnerability","description":"It was discovered that Django incorrectly handled certain inputs.\nAn attacker could possibly use this issue to perform a SQL injection.\n","status":"published","published":"2025-09-03T17:01:50Z","modified":"2026-02-10T04:49:48Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}