Skip to content

[SECURITY] SQL injection when handling dict input #134

New issue
New issue
Open
#135
Open
[SECURITY] SQL injection when handling dict input#134
#135
@Cycloctane

Description

@Cycloctane
Cycloctane
opened on Jul 26, 2025

There was a SQL injection vulnerability in PyMySQL (CVE-2024-36039), with the root cause in its converters.py. asyncmy's cython version of converters seems to have the same issue, which makes asyncmy also vulnerable.

details:

asyncmy/asyncmy/converters.pyx

Lines 29 to 34 in 2497b7b

cpdef dict escape_dict(dict val, str charset, mapping: dict = None):
n = {}
for k, v in val.items():
quoted = escape_item(v, charset, mapping)
n[k] = quoted
return n

Only dict values are escaped. This allows SQL injection when dict keys can be controlled by user's input.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions