pg8000 SQL injection vulnerability via a specially crafted Python list input

CRITICAL 9.6CVE-2025-61385 · GHSA-wq2g-r956-j8cc · PYSEC-2026-1766 · Published 27/10/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
pg8000 PyPI	`< 1.31.5`	`1.31.5`

Description

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

NVD description

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

References

nvd.nist.gov/vuln/detail/CVE-2025-61385 · ADVISORY
codeberg.org/tlocke/pg8000 · PACKAGE
codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140 · WEB
bmcyver/vulnerability-research · WEB
pypi.org/project/pg8000 · PACKAGE
GitHub Advisory GHSA-wq2g-r956-j8cc · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free