pg8000 SQL injection vulnerability via a specially crafted Python list input

严重 9.6CVE-2025-61385 · GHSA-wq2g-r956-j8cc · PYSEC-2026-1766 · Published 27/10/2025 · updated 17/06/2026

要点

CVE-2025-61385 是影响 pg8000 的严重 (CVSS 9.6)漏洞。
未来 30 天内被利用的概率（EPSS）：0.36%，高于 30.2% 的漏洞。
修复：升级到 1.31.5 或更高版本。

Package	Affected versions	Patched versions
pg8000 PyPI	`< 1.31.5`	`1.31.5`

Description

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

NVD description

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

References

nvd.nist.gov/vuln/detail/CVE-2025-61385 · ADVISORY
codeberg.org/tlocke/pg8000 · PACKAGE
codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140 · WEB
bmcyver/vulnerability-research · WEB
pypi.org/project/pg8000 · PACKAGE
GitHub Advisory GHSA-wq2g-r956-j8cc · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free