CVE-2025-64459
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
CRITICAL 9.1EPSS 19.3%
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.
- Affected
- djangoproject · Django
- CVSS v3.1 CNA
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 19.26% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2025-11-05
- Updated
- 2026-02-26
Proof-of-concept exploits (6)
- 0xCyberstan/CVE-2025-64459-Poc2★ · 2025-12-01
- Lucas-Cyber-Security/CVE_Projects0★ · 2026-06-02
- alxsourin/Helpdesk-Telecom-CVE-2025-644590★ · 2026-01-09
- joshualent/django-cve-2025-644590★ · 2026-06-23
- omarkurt/django-connector-CVE-2025-64459-testbed2★ · 2025-11-21
- rafaelchriss/RedTeamBrasil-CVE-2025-644590★ · 2026-07-07
ExploitDB entries (1)
Security advisories
- https://docs.djangoproject.com/en/dev/releases/security
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases
- https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
- advisories/GHSA-frmv-pr5f-9mcr