PYSEC-2026-489
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/products-sqlalchemyda/PYSEC-2026-489.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-489
- Aliases
- Published
- 2026-06-29T11:50:40.542423Z
- Modified
- 2026-07-01T20:23:02.176443Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- SQLAlchemyDA unauthenticated arbitrary SQL query execution
- Details
-
Impact
The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.
Patches
The problem has been patched in version 2.2.
### Workarounds There is no workaround. All users are urged to upgrade to version 2.2
- References
-
- https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw
- https://nvd.nist.gov/vuln/detail/CVE-2024-24811
- https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a
- https://github.com/zopefoundation/Products.SQLAlchemyDA
- https://pypi.org/project/products-sqlalchemyda
- https://github.com/advisories/GHSA-r3jc-3qmm-w3pw
Affected packages
PyPI / products-sqlalchemyda
Package
- Name
- products-sqlalchemyda
- View open source insights on deps.dev
- Purl
- pkg:pypi/products-sqlalchemyda
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.2