Listen to this Post
How the CVE Works:
The vulnerability exists in the `pg8000.native.literal` function of pg8000 version 1.31.4. This function is intended to safely convert Python values into SQL literals to prevent SQL injection. However, when a specially crafted Python list is passed to this function, it fails to properly sanitize the input. Instead of correctly escaping the list contents or throwing an error, the function improperly concatenates the list elements into the resulting SQL query string without adequate escaping. This allows an attacker to inject arbitrary SQL commands by supplying a list containing malicious SQL fragments. When this tainted output is incorporated into a database query, the injected commands are executed on the PostgreSQL server, potentially leading to unauthorized data access, modification, or deletion.
Platform: pg8000
Version: 1.31.4
Vulnerability: SQL Injection
Severity: High
date: 2025-10-27
Prediction: Patch 2025-11-03
What Undercode Say:
pip list | grep pg8000
Vulnerable Code Snippet
import pg8000.native
malicious_list = ["1; DROP TABLE users --"]
query = f"SELECT FROM products WHERE id = {pg8000.native.literal(malicious_list)}"
Resulting query: SELECT FROM products WHERE id = 1; DROP TABLE users --
How Exploit:
Craft malicious list input containing SQL payloads to be passed to pg8000.native.literal. The payload executes when the resulting string is used in a database query, allowing data exfiltration or database manipulation.
Protection from this CVE:
Upgrade pg8000 immediately. Use parameterized queries. Sanitize all inputs. Avoid using `pg8000.native.literal` with untrusted list inputs.
Impact:
Arbitrary SQL execution. Data theft. Data loss. Full database compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
