# Documentation Django 6.0.7

# Django 4.2.24 release notes

September 3, 2025

Django 4.2.24 fixes a security issue with severity « high » in 4.2.23.

## CVE-2025-57833: Potential SQL injection in `FilteredRelation` column aliases

`FilteredRelation` was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()`.