Remote Yes

Type Sql injection

Description

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

AVG-2667 python-django 4.0.3-1 4.0.4-1 High Fixed

https://www.djangoproject.com/weblog/2022/apr/11/security-releases/