---
id: CVE-2024-36039
aliases:
  - GHSA-v9hf-5j83-6xpp
  - PYSEC-2026-502
title: PyMySQL SQL Injection vulnerability
summary: PyMySQL SQL Injection vulnerability
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: pymysql
product: pymysql
ecosystem: pip
affected:
  - pymysql < 1.1.1
patched:
  - pymysql 1.1.1
published: '2024-05-21'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:14.333220721Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-v9hf-5j83-6xpp'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-36039'
  - url: >-
      https://github.com/PyMySQL/PyMySQL/commit/521e40050cb386a499f68f483fefd144c493053c
  - url: 'https://github.com/PyMySQL/PyMySQL'
  - url: 'https://github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1'
  - url: 'https://lists.debian.org/debian-lts-announce/2024/05/msg00017.html'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23VXBV34GFRICCVYZ6KFMSSWY5UEXCF5
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00691
epssPercentile: 0.50872
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/zenniskayy2k4/CVE-2024-36039_PoC'
  checkedAt: '2026-09-27T10:33:30.899Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.729Z'
---

## Overview

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.

## Affected packages

- `pymysql < 1.1.1`

## Remediation

Upgrade to a patched release:

- `pymysql 1.1.1`