A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Apr 12, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 12, 2022 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-maintainUpgrade rubygem-apipie-bindingsUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade foreman-cliUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unfUpgrade satellite-cloneUpgrade rubygem-little-pluggerUpgrade rubygem-foreman_maintainUpgrade rubygem-oauthUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-netrcUpgrade rubygem-netrcUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hashieUpgrade tfm-rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_extUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-unfUpgrade rubygem-multi_jsonUpgrade rubygem-domain_nameUpgrade rubygem-mime-typesUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-highlineUpgrade rubygem-powerbarUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-loggingUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-clampUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_azure_rm | Jul 14, 2022 | Apr 12, 2022 |
| Debian | — | Upgrade python-django | Nov 4, 2022 | Apr 12, 2022 |
| Freebsd | — | Upgrade py39-django22Upgrade py39-django32Upgrade py310-django22Upgrade py310-django32Upgrade py38-django32Upgrade py39-django40Upgrade py38-django40Upgrade py37-django22Upgrade py37-django32Upgrade py310-django40Upgrade py38-django22 | Nov 4, 2022 | Apr 12, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-multi_jsonUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-http-cookieUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unicodeUpgrade rubygem-amazing_printUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade foreman-cliUpgrade rubygem-highlineUpgrade tfm-rubygem-unicodeUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hashieUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-netrcUpgrade rubygem-rest-clientUpgrade tfm-rubygem-powerbarUpgrade tfm-runtimeUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-domain_nameUpgrade tfm-rubygem-rest-clientUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade tfm-rubygem-oauthUpgrade rubygem-localeUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unf_extUpgrade rubygem-clampUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-mime-typesUpgrade satellite-cli | Jul 14, 2022 | Apr 12, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 12, 2024 | Apr 12, 2022 |
| Suse | — | Upgrade python3-django | Jan 4, 2023 | Apr 12, 2022 |
| Ubuntu | — | Upgrade python3-django | Mar 22, 2023 | Apr 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub