Documentation contents

Django 5.2.6 release notesLink to this heading

September 3, 2025

Django 5.2.6 fixes a security issue with severity «high» and one bug in 5.2.5.

CVE-2025-57833: Potential SQL injection in `FilteredRelation` column aliasesLink to this heading

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().

Correzioni di bugLink to this heading

Fixed a bug where using QuerySet.values() or values_list() with a ForeignObject composed of multiple fields returned incorrect results instead of tuples of the referenced fields (#36431).

View as Markdown Edit this page on GitHub Official version