CVE-2025-61385

CRITICAL9.6

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal

Published Oct 27, 2025

Modified 11 months ago

Details

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

References

WEB

https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140

WEB

https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-61385

CVSS Analysis

CVSS v3.1

9.6

Exploitability

Attack Vector