SQLAlchemyDA unauthenticated arbitrary SQL query execution

严重 9.8CVE-2024-24811 · GHSA-r3jc-3qmm-w3pw · PYSEC-2026-489 · Published 07/02/2024 · updated 17/06/2026

要点

CVE-2024-24811 是影响 products-sqlalchemyda, sqlalchemyda (zope) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.89%，高于 59.4% 的漏洞。
修复：升级到 2.2 或更高版本。

Package	Affected versions	Patched versions
products-sqlalchemyda PyPI	`< 2.2`	`2.2`
sqlalchemyda zope	`< 2.2`	`2.2`

Description

Impact

The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.

Patches

The problem has been patched in version 2.2.

Workarounds

There is no workaround. All users are urged to upgrade to version 2.2

NVD description

SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.

References

zopefoundation/Products.SQLAlchemyDA security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-24811 · ADVISORY
zopefoundation/Products.SQLAlchemyDA commit e682b99 · WEB
zopefoundation/Products.SQLAlchemyDA · PACKAGE
pypi.org/project/products-sqlalchemyda · PACKAGE
GitHub Advisory GHSA-r3jc-3qmm-w3pw · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

products-sqlalchemyda

PyPI

< 2.2

2.2

sqlalchemyda

zope

< 2.2

2.2

Description

Impact

The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.

Patches

The problem has been patched in version 2.2.

Workarounds

There is no workaround. All users are urged to upgrade to version 2.2

NVD description