PT-2026-53564 · Pypi · Products-Sqlalchemyda

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact

The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.

Patches

The problem has been patched in version 2.2.

Workarounds

There is no workaround. All users are urged to upgrade to version 2.2

Fix

Related Identifiers

PYSEC-2026-489

Affected Products

Products-Sqlalchemyda

References · 7

• https://osv.dev/vulnerability/PYSEC-2026-489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24811 · Security Note
• https://github.com/zopefoundation/Products.SQLAlchemyDA · Note
• https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw · Note
• https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a · Note
• https://pypi.org/project/products-sqlalchemyda · Note
• https://github.com/advisories/GHSA-r3jc-3qmm-w3pw · Note