{"id":"CVE-2025-61385","aliases":["GHSA-wq2g-r956-j8cc","PYSEC-2026-1766"],"title":"pg8000 SQL injection vulnerability via a specially crafted Python list input","summary":"pg8000 SQL injection vulnerability via a specially crafted Python list input","severity":"high","vendor":"pg8000","product":"pg8000","ecosystem":"pip","affected":["pg8000 < 1.31.5"],"patched":["pg8000 1.31.5"],"published":"2025-10-27","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wq2g-r956-j8cc","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61385"},{"url":"https://codeberg.org/tlocke/pg8000"},{"url":"https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140"},{"url":"https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385"}],"tags":["osv","pip"],"epss":0.00339,"epssPercentile":0.27325,"ingestedAt":"2026-07-08T18:25:53.873Z","slug":"CVE-2025-61385","body":"## Overview\n\nSQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.\n\n## Affected packages\n\n- `pg8000 < 1.31.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pg8000 1.31.5`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}