PT-2024-4421 · Pypi+10 · Pymysql+10
Published
2024-05-21
·
Updated
2026-06-03
·
CVE-2024-36039
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PyMySQL versions 1.1.0 and earlier
Description
The issue is related to the JSON Handler component of the PyMySQL library for Python, which does not properly escape keys using the
escape dict procedure. This can allow a remote attacker to gain unauthorized access to data, tamper with data, or execute arbitrary code on the internal database server if untrusted JSON input is used. The exploitation of this issue can lead to SQL injection.Recommendations
For PyMySQL versions 1.1.0 and earlier, consider disabling the use of untrusted JSON input until a patch is available. As a temporary workaround, restrict the use of the
escape dict function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Pymysql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu