CVE-2024-36039

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-36039
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36039.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-36039
Aliases
Downstream
AZL (2)
CGA (2)
CLSA (1)
DEBIAN (1)
OESA (1)
openSUSE (2)
RHSA (4)
RLSA (3)
ROOT (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (4)
openSUSE (2)
RLSA (1)
SUSE (2)
Published
2024-05-21T00:00:00Z
Modified
2026-10-21T02:51:31Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36039.json"
}
References

Affected packages

Git / github.com/pymysql/pymysql

Affected ranges

Type
GIT
Repo
https://github.com/pymysql/pymysql
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2cab9ecc641e962565c6254a5091f90c47f59b35
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.1.0"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "original_tag":  "v1.1.1",
            "range":  [
                {
                    "fixed":  "2cab9ecc641e962565c6254a5091f90c47f59b35"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.6.7
0.7.0
0.7.1
0.7.2
pymysql-0.*
pymysql-0.5
pymysql-0.6
pymysql-0.6.1
pymysql-0.6.2
pymysql-0.6.3
pymysql-0.6.4
pymysql-0.6.5
pymysql-0.6.6
v0.*
v0.10.0
v0.10.1
v0.6.7
v0.7.0
v0.7.1
v0.7.10
v0.7.11
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.1
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.3rc1
v1.1.0
v1.1.0rc1
v1.1.0rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36039.json"