CVE-2022-28346: Debian Linux

Critical severity, CVSS 9.8. EPSS: 18.7% chance of exploitation in the next 30 days.

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Affected products

• Debian Debian Linux: version 9.0 only; version 11.0 only
• Djangoproject Django: from 2.2, before 2.2.28 (fixed in 2.2.28); from 3.2, before 3.2.13 (fixed in 3.2.13); from 4.0, before 4.0.4 (fixed in 4.0.4)

Published 2022-04-12. Last modified 2026-06-17.