# Django 5.2.17 documentation

# Django 5.2.6 release notes

September 3, 2025

Django 5.2.6 fixes a security issue with severity “high” and one bug in 5.2.5.

## CVE-2025-57833: Potential SQL injection in `FilteredRelation` column aliases

`FilteredRelation` was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()`.

## Bugfixes

- Fixed a bug where using `QuerySet.values()` or `values_list()` with a `ForeignObject` composed of multiple fields returned incorrect results instead of tuples of the referenced fields (#36431).