---
id: CVE-2025-61385
aliases:
  - GHSA-wq2g-r956-j8cc
  - PYSEC-2026-1766
title: pg8000 SQL injection vulnerability via a specially crafted Python list input
summary: pg8000 SQL injection vulnerability via a specially crafted Python list input
severity: high
vendor: pg8000
product: pg8000
ecosystem: pip
affected:
  - pg8000 < 1.31.5
patched:
  - pg8000 1.31.5
published: '2025-10-27'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wq2g-r956-j8cc'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61385'
  - url: 'https://codeberg.org/tlocke/pg8000'
  - url: >-
      https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140
  - url: 'https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385'
tags:
  - osv
  - pip
epss: 0.00339
epssPercentile: 0.27325
ingestedAt: '2026-07-08T18:25:53.873Z'
---

## Overview

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

## Affected packages

- `pg8000 < 1.31.5`

## Remediation

Upgrade to a patched release:

- `pg8000 1.31.5`