---
title: "Django 1.11.28 release notes"
version: 6.0
locale: pl
source: https://docs.djangoproject.com/pl/6.0/releases/1.11.28/
canonical: https://djangodocs.dev/pl/6.0/releases/1.11.28/
---
# Django 1.11.28 release notes

*February 3, 2020*

Django 1.11.28 fixes a security issue in 1.11.27.

## CVE-2020-7471: Potential SQL injection via `StringAgg(delimiter)`

[`StringAgg`](/pl/6.0/ref/contrib/postgres/aggregates/#django.contrib.postgres.aggregates.StringAgg) aggregation function was
subject to SQL injection, using a suitably crafted `delimiter`.