{"id":"CVE-2024-24811","aliases":["GHSA-r3jc-3qmm-w3pw","PYSEC-2026-489"],"title":"SQLAlchemyDA unauthenticated arbitrary SQL query execution","summary":"SQLAlchemyDA unauthenticated arbitrary SQL query execution","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"products-sqlalchemyda","product":"products-sqlalchemyda","ecosystem":"pip","affected":["products-sqlalchemyda < 2.2"],"patched":["products-sqlalchemyda 2.2"],"published":"2024-02-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:06.413628614Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-r3jc-3qmm-w3pw","references":[{"url":"https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24811"},{"url":"https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a"},{"url":"https://github.com/zopefoundation/Products.SQLAlchemyDA"}],"tags":["osv","pip"],"epss":0.00889,"epssPercentile":0.57569,"ingestedAt":"2026-09-12T03:13:01.724Z","slug":"CVE-2024-24811","body":"## Overview\n\n### Impact\nThe vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.\n\n### Patches\nThe problem has been patched in version 2.2. \n\n### Workarounds\nThere is no workaround. All users are urged to upgrade to version 2.2\n\n\n## Affected packages\n\n- `products-sqlalchemyda < 2.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `products-sqlalchemyda 2.2`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}