PT-2026-53564 · Pypi · Products-Sqlalchemyda

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact

The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.

Patches

The problem has been patched in version 2.2.

Workarounds

There is no workaround. All users are urged to upgrade to version 2.2

Correção

Identificadores relacionados

PYSEC-2026-489

Produtos afetados

Products-Sqlalchemyda

Referências · 7

• https://github.com/zopefoundation/Products.SQLAlchemyDA · Nota
• https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw · Nota
• https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a · Nota
• https://pypi.org/project/products-sqlalchemyda · Nota
• https://github.com/advisories/GHSA-r3jc-3qmm-w3pw · Nota
• https://osv.dev/vulnerability/PYSEC-2026-489 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-24811 · Nota de Segurança