Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2025-64459: Django may let attackers execute code
CVE-2025-64459 · published today
Summary
Certain versions of Django can be tricked into running malicious code, which could let an attacker take control of your web application. The flaw has been fixed in newer releases from the official Django packages and the Root‑maintained package. Update Django to the latest patched version as soon as possible.
What to do
- Update django software foundation django to version 5.2.8.
- Update django software foundation django to version 5.1.14.
- Update django software foundation django to version 4.2.26.
- Update django software foundation django to version 5.2.1+echo.1.
- Update django to version 5.2.8.
- Update rootio-django to version 4.1.13+root.io.1.
- Update rootio-django to version 4.1.13+root.io.2.
- Update django software foundation django to version 4.1.13+aikido.2.
- Update rootio-django to version 3.2.25+root.io.1.
- Update django software foundation django to version 3.2.25+aikido.1.
- Update rootio-django to version 2.2.28+root.io.1.
- Update django to version 2.2.28+aikido.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | django software foundation | django |
>= 5.2a1, < 5.2.8 >= 5.0a1, < 5.1.14 < 4.2.26 Fix: upgrade to 5.2.8
|
| – | djangoproject | django |
>= 4.2, < 4.2.26 >= 5.1, < 5.1.14 >= 5.2, < 5.2.8 cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
| PyPI | django software foundation | django |
< 5.2.1+echo.1 Fix: upgrade to 5.2.1+echo.1
|
| Bitnami | – | django |
>= 5.2.0, < 5.2.8 Fix: upgrade to 5.2.8
|
| Root:PyPI | – | rootio-django |
< 4.1.13+root.io.1 < 4.1.13+root.io.2 < 3.2.25+root.io.1 < 2.2.28+root.io.1 Fix: upgrade to 4.1.13+root.io.1
|
| Root:PyPI | django software foundation | django |
< 4.1.13+aikido.2 < 3.2.25+aikido.1 Fix: upgrade to 4.1.13+aikido.2
|
| Root:PyPI | – | django |
< 2.2.28+aikido.5 Fix: upgrade to 2.2.28+aikido.5
|
Original advisory text
CVE-2025-64459 in django - Patched by Root
Root has patched CVE-2025-64459 in the django package for Root:PyPI. Multiple fixed versions available.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-64459
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce Mailing List
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases
- https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
- https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
- https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
- https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
- https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
- https://github.com/advisories/GHSA-frmv-pr5f-9mcr
- https://docs.djangoproject.com/en/dev/releases/security/ Vendor Advisory
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases/ Vendor Advisory
- https://advisory.echohq.com/cve/CVE-2025-64459 URL
- https://github.com/django/django Product
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108....
- https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-6... Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen6 Mar 2026
Sources
GHSA-frmv-pr5f-9mcr · GHSA
CVE-2025-64459 · NVD
CVE-2025-64459 · OSV
ECHO-1dc5-af13-00c1 · OSV
GHSA-frmv-pr5f-9mcr · OSV
Track software like this
Free during beta