Django 4.2.24 release notes

September 3, 2025

Django 4.2.24 fixes a security issue with severity "high" in 4.2.23.

CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().

« previous | up | next »