---
title: "Django 5.2.6 release notes"
version: 5.2
locale: ko
source: https://docs.djangoproject.com/ko/5.2/releases/5.2.6/
canonical: https://djangodocs.dev/ko/5.2/releases/5.2.6/
---
# Django 5.2.6 release notes

*September 3, 2025*

Django 5.2.6 fixes a security issue with severity “high” and one bug in 5.2.5.

## CVE-2025-57833: Potential SQL injection in `FilteredRelation` column aliases

[`FilteredRelation`](/ko/5.2/ref/models/querysets/#django.db.models.FilteredRelation) was subject to SQL injection in column aliases,
using a suitably crafted dictionary, with dictionary expansion, as the
`**kwargs` passed to [`QuerySet.annotate()`](/ko/5.2/ref/models/querysets/#django.db.models.query.QuerySet.annotate) or [`QuerySet.alias()`](/ko/5.2/ref/models/querysets/#django.db.models.query.QuerySet.alias).

## 버그 수정

- Fixed a bug where using `QuerySet.values()` or `values_list()` with a
  `ForeignObject` composed of multiple fields returned incorrect results
  instead of tuples of the referenced fields ([#36431](https://code.djangoproject.com/ticket/36431)).