GHSA-xv6x-43gq-4hfj PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection

• PyPI PyGreSQL: <= 3.8.1 (no fix yet) • PyPI PyGreSQL: >= 4.0, < 4.1 → fixed in 4.1

PyGreSQL 3.8 did not use PostgreSQL’s safe `string` and `bytea` functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, `pg.escape_string()` and `pg.escape_bytea()` are still available, but applications will have to be adjusted to use the new `pyobj.escape_string()` and `pyobj.escape_bytea()` functions. For example, code containing: ```python import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input) ``` should be adjusted to use: ```python import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input) ```