PT-2026-6457 · Pypi · Records-Mover

Published 2026-01-08 · Updated 2026-01-08

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This manipulation causes SQL Injection. The attack needs to be launched locally. Upgrading to version 1.6.0 is sufficient to fix this issue. Patch name: 3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa. Developers should upgrade the affected component.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

GHSA-P3JP-7GJ7-H6PR

Affected Products

Records-Mover

References · 8

• https://osv.dev/vulnerability/GHSA-p3jp-7gj7-h6pr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7333 · Security Note
• https://github.com/bluelabsio/records-mover/pull/254 · Note
• https://github.com/bluelabsio/records-mover/commit/3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa · Note
• https://github.com/bluelabsio/records-mover/releases/tag/v1.6.0 · Note
• https://github.com/bluelabsio/records-mover · Note
• https://vuldb.com/?ctiid.339566 · Note
• https://vuldb.com/?id.339566 · Note