GitHub Advisoryadvisory · PyPI

GHSA-qhqw-rrw9-25rm asyncmy is vulnerable to SQL injection via crafted dict keys

CRITICAL Published 2025-12-02 Modified 2026-07-02 Official page ↗
Aliases
CVE-2025-65896
Ecosystem
PyPI
Packages
asyncmy
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2025-12-03

Affected packages

• PyPI asyncmy: <= 0.2.11 (no fix yet)

Description

SQL injection vulnerability in long2ice asyncmy thru 0.2.11 allows attackers to execute arbitrary SQL commands via crafted dict keys.

Related

Alias · CVE (1)

  • CVE-2025-65896 SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References