An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.

Summary

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Timeline

1. Apr 12, 2022, 12:00 AM UTCCVE published
2. Feb 13, 2025, 4:32 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• djangoPyPI

  From 2.2 · fixed in 2.2.28

• djangoPyPI

  From 3.2 · fixed in 3.2.13

• djangoPyPI

  From 4.0 · fixed in 4.0.4

• djangoPyPI

  From 4.0 · fixed in 4.0.4; From 3.2 · fixed in 3.2.13; From 2.2 · fixed in 2.2.28

References 13