Executive Summary

On November 5, 2025, the Django security team disclosed and patched a critical SQL injection vulnerability, CVE-2025-64459. The flaw has a CVSS v3.1 score of 9.1, reflecting its severity and ease of exploitation. It exists within the framework's Object-Relational Mapping (ORM) component and can be triggered when a dictionary with dictionary expansion is used as a _connector argument in specific QuerySet methods. An unauthenticated attacker could exploit this to execute arbitrary SQL commands, leading to a complete compromise of the application's data confidentiality and integrity. Patches have been released in Django versions 5.2.8, 5.1.14, and 4.2.26. All organizations using affected Django versions are urged to upgrade immediately.

Vulnerability Details

The vulnerability CVE-2025-64459 is a classic SQL injection flaw but with a novel entry point through the Django ORM's internal mechanisms. The flaw resides in how the QuerySet.filter(), QuerySet.exclude(), and QuerySet.get() methods handle dictionary expansion (**kwargs) when used with a specific internal parameter.

An attacker can exploit this by crafting a dictionary where a key is _connector and passing it to one of the vulnerable methods using dictionary expansion. For example: MyModel.objects.filter(**{"_connector": "' OR 1=1 --"})

Normally, the _connector argument is used internally to specify logical operators (AND/OR). However, the vulnerability arises because the framework failed to properly sanitize this parameter when it was supplied through user-controlled dictionary expansion, allowing raw SQL to be injected directly into the WHERE clause of the database query.

A second, less severe denial-of-service vulnerability, CVE-2025-64458, was also patched in the same release, affecting applications on Windows.

Affected Systems

The vulnerability affects the following supported and pre-release versions of Django:

• Django 5.2 (before version 5.2.8)
• Django 5.1 (before version 5.1.14)
• Django 4.2 (before version 4.2.26)
• Django 6.0 (beta versions)

Older, unsupported versions of Django are also likely to be affected.

Exploitation Status

There are no public reports of in-the-wild exploitation at the time of disclosure. However, the low complexity of the attack and the public availability of technical details mean that exploits are likely to be developed and used quickly. Proactive patching is essential.

Impact Assessment

Successful exploitation of CVE-2025-64459 can have severe consequences, including:

• Data Exfiltration: Attackers can bypass access controls and read any data from the application's database, including user credentials, personal information, and financial records.
• Authentication Bypass: An attacker could manipulate login queries to bypass authentication and gain unauthorized access to privileged accounts.
• Data Modification/Deletion: Attackers could alter or delete records in the database, corrupting data and disrupting business operations.
• Denial of Service: Malicious queries could be crafted to overload the database server, causing a denial of service.
• Potential for RCE: Depending on the database configuration and permissions, SQL injection can sometimes be escalated to achieve remote code execution on the database server.

Cyber Observables for Detection

Detection Methods

1. Web Application Firewall (WAF): Deploy a WAF with rules specifically designed to detect and block SQL injection patterns. A custom rule could be created to block any request containing _connector as a query parameter, as this is not a standard use case.
2. Static and Dynamic Analysis (SAST/DAST): Use SAST tools to scan Django codebases for instances where user-controlled dictionaries are passed directly to filter(), exclude(), or get() methods. DAST tools can be used to actively probe running applications for the vulnerability.
3. Code Review: Manually review code that constructs dynamic QuerySet filters based on user input to ensure it does not allow for the injection of the _connector key.

Remediation Steps

1. Upgrade Django: The primary and most effective remediation is to upgrade to a patched version of the framework. Developers should upgrade according to their current version branch:
   • If on 5.2.x, upgrade to Django 5.2.8
   • If on 5.1.x, upgrade to Django 5.1.14
   • If on 4.2.x, upgrade to Django 4.2.26 This is a direct application of D3-SU: Software Update.
2. Input Validation (Workaround): If immediate upgrade is not possible, developers must implement strict validation on any user-controlled data that is used to construct a dictionary for QuerySet methods. Ensure that keys like _connector are explicitly stripped out before being passed to the ORM. This is a form of D3-ACH: Application Configuration Hardening.