PT-2025-44000 · Pg8000 · Pg8000

Published 2025-10-27 · Updated 2025-10-29 · CVE-2025-61385

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pg8000 version 1.31.4

Description A SQL injection flaw exists in pg8000. This issue allows remote attackers to execute arbitrary SQL commands by providing a specially crafted Python list as input to the pg8000.native.literal function. The vulnerability is due to insufficient input validation when processing the Python list.

Recommendations Update pg8000 to a newer version that addresses this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-61385

ECHO-1229-D2C8-A3C8

GHSA-WQ2G-R956-J8CC

Affected Products

Pg8000

References · 9

• 🔥 https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61385 · Security Note
• https://osv.dev/vulnerability/GHSA-wq2g-r956-j8cc · Vendor Advisory
• https://reddit.com/r/VulnMatter/comments/1oibp2u/resumen_diario_de_vulnerabilidades_28102025 · Reddit Post
• https://twitter.com/CVEnew/status/1982867553677361259 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1oj4i5j/resumen_diario_de_vulnerabilidades_29102025 · Reddit Post
• https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140 · Note
• https://twitter.com/pHo9UBenaA/status/1983136491066011839 · Twitter Post
• https://codeberg.org/tlocke/pg8000 · Note