7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-57833

CVE-2025-57833: Django is subject to SQL injection through its column aliases

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-57833

CVE-2025-57833:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Django	pip	< 4.2.24	4.2.24
Django	pip	>= 5.0a1, < 5.1.12	5.1.12
Django	pip	>= 5.2a1, < 5.2.6	5.2.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the add_filtered_relation method of the Query class in django/db/models/sql/query.py. The provided patches for CVE-2025-57833 clearly show that a security fix was applied to this specific function across multiple Django branches (4.2, 5.1, and 5.2). The fix involves adding a call to self.check_alias(alias) at the beginning of the function. This indicates that the alias parameter was not being properly sanitized before being used in an SQL query, which is the root cause of the SQL injection vulnerability.

The vulnerability is triggered when a user calls QuerySet.annotate() or QuerySet.alias() with a FilteredRelation object and a crafted dictionary for the **kwargs. The key of this dictionary is used as the alias. The call to annotate or alias eventually leads to a call to add_filtered_relation, passing the malicious alias. The added test cases in tests/annotations/tests.py confirm this exploitation path by demonstrating how a crafted alias can be used with FilteredRelation in both annotate and alias calls to trigger the vulnerability.

Therefore, the primary vulnerable function is Query.add_filtered_relation as it is the exact location where the unsanitized input is processed. While QuerySet.annotate and QuerySet.alias are the entry points for an attacker, the vulnerability itself is contained within add_filtered_relation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.