A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Apr 12, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 12, 2022 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-amazing_printUpgrade rubygem-domain_nameUpgrade tfm-rubygem-mime-typesUpgrade rubygem-multi_jsonUpgrade rubygem-unf_extUpgrade rubygem-http-cookieUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-clampUpgrade tfm-rubygem-unfUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-runtimeUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-highlineUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-loggingUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satellite-cliUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-http-cookieUpgrade rubygem-oauthUpgrade rubygem-netrcUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade rubygem-rest-clientUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-cloneUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-clampUpgrade foreman-cliUpgrade tfm-rubygem-unicodeUpgrade satellite-maintainUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-domain_name | Jul 14, 2022 | Apr 12, 2022 |
| Debian | — | Upgrade python-django | Nov 4, 2022 | Apr 12, 2022 |
| Freebsd | — | Upgrade py38-django40Upgrade py37-django22Upgrade py37-django32Upgrade py38-django22Upgrade py310-django40Upgrade py39-django22Upgrade py310-django32Upgrade py39-django40Upgrade py38-django32Upgrade py310-django22Upgrade py39-django32 | Nov 4, 2022 | Apr 12, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-clampUpgrade tfm-rubygem-unf_extUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-localeUpgrade rubygem-unf_extUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-http-cookieUpgrade rubygem-localeUpgrade tfm-rubygem-mime-typesUpgrade rubygem-netrcUpgrade rubygem-mime-typesUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-highlineUpgrade rubygem-unicode-debugsourceUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-powerbarUpgrade rubygem-rest-clientUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade tfm-runtimeUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-rest-clientUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debuginfoUpgrade rubygem-powerbarUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unfUpgrade rubygem-apipie-bindingsUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-oauthUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-mime-types-dataUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-highlineUpgrade tfm-rubygem-jwt | Jul 14, 2022 | Apr 12, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 12, 2024 | Apr 12, 2022 |
| Suse | — | Upgrade python3-django | Jan 4, 2023 | Apr 12, 2022 |
| Ubuntu | — | Upgrade python3-django | Mar 22, 2023 | Apr 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub