Is django affected by CVE-2025-64459?

PyPI django is affected in >=5.2a1 =5.0a1 <5.1.14, <4.2.26.

Is CVE-2025-64459 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 18.8%.

critical

CVE-2025-64459

Q: Is CVE-2025-64459 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 18.8%.

PyPI · django

Summary

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

Severity: critical
EPSS: 18.8% (p97)
Also known as: GHSA-frmv-pr5f-9mcr, BIT-django-2025-64459, PYSEC-2025-108
Published: 2025-11-05

References

https://nvd.nist.gov/vuln/detail/CVE-2025-64459
https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4

Related advisories

CVE-2026-4277 — critical · PyPI/django
CVE-2026-3902 — high · PyPI/django
CVE-2026-33034 — high · PyPI/django
CVE-2026-25673 — high · PyPI/django
CVE-2026-1287 — high · PyPI/django
CVE-2026-1207 — high · PyPI/django
CVE-2026-1285 — high · PyPI/django
CVE-2025-14550 — high · PyPI/django

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.