CVE-2022-28346: SQL Injection in Django

django Updated 02 Oct 2025

Summary

12/04/2022

Disclosed on

CVE-2022-28346

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2022-28346: An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. Affects django across 3 version ranges.

>= 2.2, < 2.2.28 >= 3.2, < 3.2.13 >= 4.0, < 4.0.4

Fixed in 2.2.28, 3.2.13 or 4.0.4, depending on the release line you run. How to fix ↓

Also tracked for

django · Bitnami
python-django · Debian:11

The same CVE-2022-28346 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Django is a popular Python web framework that simplifies the development of web applications. It provides a robust set of tools and features for building secure and scalable websites. However, versions 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 of Django are vulnerable to a SQL injection attack. This vulnerability affects the QuerySet.annotate(), aggregate(), and extra() methods when used with a crafted dictionary as the **kwargs parameter.

Vulnerability Detail

The vulnerability arises due to improper handling of column aliases in SQL queries. An attacker can exploit this by providing a malicious dictionary that contains SQL code as the column alias. When the affected methods are called with this dictionary, the SQL code gets executed, leading to potential data leakage, unauthorized access, or even remote code execution. This vulnerability can be particularly dangerous if user-supplied data is used in the dictionary expansion.

How To Fix

Latest published version: 6.1.2 as of 22 Oct 2026

pip install --upgrade "django==6.1.2"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 2.2, < 2.2.28 2.2.28
```
pip install --upgrade "django==2.2.28"
```
>= 3.2, < 3.2.13 3.2.13
```
pip install --upgrade "django==3.2.13"
```
>= 4.0, < 4.0.4 4.0.4
```
pip install --upgrade "django==4.0.4"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading Django is not immediately feasible, a temporary workaround is to avoid using the affected methods with user-supplied data. Developers should carefully validate and sanitize any input used in the **kwargs parameter to prevent SQL injection attacks. It is crucial to follow secure coding practices and use parameterized queries or prepared statements to mitigate the risk of SQL injection.

Conclusion

The SQL injection vulnerability in Django versions 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 can have severe consequences, including data leakage and unauthorized access. It is crucial for developers to upgrade their Django installations to the patched versions or apply the recommended workarounds. For further assistance or support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for django →

FAQ

What is the impact of this vulnerability?

This vulnerability can allow an attacker to execute arbitrary SQL code, potentially leading to data leakage, unauthorized access, or remote code execution.

Are all versions of Django affected?

No, only versions 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 are vulnerable to this SQL injection issue.

Is there a known exploit for this vulnerability?

At the time of this advisory, there is no known public exploit for this vulnerability. However, it is essential to patch Django installations promptly to prevent potential exploitation.