# Django 5.2.9 ドキュメント

# Django 2.2.28 リリースノート

2022年4月11日

Django 2.2.28 では 2.2.27 における深刻度 "high" のセキュリティの問題2件を修正しました。

## CVE-2022-28346: Potential SQL injection in `QuerySet.annotate()`, `aggregate()`, and `extra()`

`QuerySet.annotate()`, `aggregate()`, and `extra()` methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to these methods.

## CVE-2022-28347: Potential SQL injection via `QuerySet.explain(**options)` on PostgreSQL

`QuerySet.explain()` method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the `**options` argument.