SQLAlchemyDA unauthenticated arbitrary SQL query execution

CRITICAL 9.8CVE-2024-24811 · GHSA-r3jc-3qmm-w3pw · PYSEC-2026-489 · Published 07/02/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
products-sqlalchemyda PyPI	`< 2.2`	`2.2`
sqlalchemyda zope	`< 2.2`	`2.2`

Description

Impact

The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.

Patches

The problem has been patched in version 2.2.

Workarounds

There is no workaround. All users are urged to upgrade to version 2.2

NVD description

SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.

References

zopefoundation/Products.SQLAlchemyDA security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-24811 · ADVISORY
zopefoundation/Products.SQLAlchemyDA commit e682b99 · WEB
zopefoundation/Products.SQLAlchemyDA · PACKAGE
pypi.org/project/products-sqlalchemyda · PACKAGE
GitHub Advisory GHSA-r3jc-3qmm-w3pw · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free