diff options
Diffstat (limited to 'docs/releases/5.2.8.txt')
| -rw-r--r-- | docs/releases/5.2.8.txt | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/docs/releases/5.2.8.txt b/docs/releases/5.2.8.txt index 947fce8d84..0a0038ba20 100644 --- a/docs/releases/5.2.8.txt +++ b/docs/releases/5.2.8.txt @@ -18,6 +18,13 @@ Windows. As a consequence, :class:`~django.http.HttpResponseRedirect`, denial-of-service attack via certain inputs with a very large number of Unicode characters (follow up to :cve:`2025-27556`). +CVE-2025-64459: Potential SQL injection via ``_connector`` keyword argument +=========================================================================== + +:meth:`.QuerySet.filter`, :meth:`~.QuerySet.exclude`, :meth:`~.QuerySet.get`, +and :class:`~.Q` were subject to SQL injection using a suitably crafted +dictionary, with dictionary expansion, as the ``_connector`` argument. + Bugfixes ======== |