Medium USN-6801-1 1 CVE

python-pymysql vulnerability

Published May 30, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PyMySQL incorrectly escaped untrusted JSON input. An
attacker could possibly use this issue to perform SQL injection attacks.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	python-pymysql	0.9.3-2ubuntu3.1
Ubuntu · 22.04 LTS 22.04:LTS	python-pymysql	1.0.2-1ubuntu1.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS	python-pymysql	1.0.2-2ubuntu1.1

Vulnerabilities 1

Medium 6.3

CVE-2024-36039 Public exploit

PyMySQL SQL Injection vulnerability

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

python-PyMySQL py3-pymysql pymysql python-pymysql Debian Ubuntu Azure Linux Wolfi PyPI

May 21, 2024

References

report
https://ubuntu.com/security/CVE-2024-36039