From 51711717098d3f469f795dfa6bc3758b24f69ef7 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Wed, 13 Aug 2025 13:13:42 +0100
Subject: Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL
 injection in column aliases.

Thanks Eyal Gabay (EyalSec) for the report.
---
 django/db/models/sql/query.py | 1 +
 1 file changed, 1 insertion(+)

(limited to 'django/db/models/sql')

diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py
index e3186c4919..f332d83946 100644
--- a/django/db/models/sql/query.py
+++ b/django/db/models/sql/query.py
@@ -1720,6 +1720,7 @@ class Query(BaseExpression):
         return target_clause, needed_inner
 
     def add_filtered_relation(self, filtered_relation, alias):
+        self.check_alias(alias)
         filtered_relation.alias = alias
         relation_lookup_parts, relation_field_parts, _ = self.solve_lookup_type(
             filtered_relation.relation_name
-- 
cgit v1.3