GitHub Advisoryadvisory · PyPI

GHSA-v9hf-5j83-6xpp PyMySQL SQL Injection vulnerability

CRITICAL Published 2024-05-21 Modified 2024-06-24 Official page ↗
Aliases
CVE-2024-36039
Ecosystem
PyPI
Packages
pymysql
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-05-21

Affected packages

• PyPI pymysql: < 1.1.1 → fixed in 1.1.1

Description

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.

Related

Alias · CVE (1)

  • CVE-2024-36039 PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References