7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59681

CVE-2025-59681: Django vulnerable to SQL injection in column aliases

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59681

CVE-2025-59681:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
django	pip	>= 4.2, < 4.2.25	4.2.25
django	pip	>= 5.1, < 5.1.13	5.1.13
django	pip	>= 5.2, < 5.2.7	5.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-59681, is an SQL injection flaw in Django's ORM, specifically affecting MySQL and MariaDB backends. The root cause lies in the insufficient validation of column aliases provided by the user. The analysis of the security patch 41b43c74bda19753c757036673ea9db74acf494a reveals that the core of the issue is in the django.db.models.sql.query.Query.check_alias function. This function used a regular expression (FORBIDDEN_ALIAS_PATTERN) to detect and block potentially malicious characters in aliases, but it failed to include the hash character (#), which can initiate a comment in MySQL.

The patch rectifies this by adding # to the forbidden pattern. While check_alias is the function with the flawed logic, it is an internal method. The vulnerability is triggered through several public QuerySet methods that accept user-defined aliases via **kwargs or dictionary arguments. The CVE description and the commit message explicitly name QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() as the affected methods. These methods serve as the entry points for an attacker to pass a crafted alias (e.g., \"alias_name # -- comment\") which would then be processed by the vulnerable check_alias function, leading to SQL injection. Therefore, all five functions are identified as critical for profiling and detection. The QuerySet methods would appear higher in the stack trace as the user-facing entry points, while check_alias is the deeper function where the security control failed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.