CVE-2025-64459

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

State: Published
Severity: 9.1 Critical
Published: Nov 5, 2025
Updated: Feb 26, 2026
Reserved: Nov 4, 2025

Description

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Djangodjangoproject	5.2 to before 5.2.8Affected 5.2.8Not affected 5.1 to before 5.1.14Affected 5.1.14Not affected 4.2 to before 4.2.26Affected 4.2.26Not affected

References

Django security archivevendor-advisory
Django releases announcementsmailing-list
Django security releases issued: 5.2.8, 5.1.14, and 4.2.26vendor-advisory
https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.