What is GHSA-wq2g-r956-j8cc?

GHSA-wq2g-r956-j8cc is a security advisory published by GitHub Security Advisories with High severity. pg8000 SQL injection vulnerability via a specially crafted Python list input

Which CVE IDs does GHSA-wq2g-r956-j8cc cover?

GHSA-wq2g-r956-j8cc covers the following CVE IDs: CVE-2025-61385. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-wq2g-r956-j8cc?

GHSA-wq2g-r956-j8cc affects 1 product, including: pip/pg8000:\u003c= 1.31.4.

GHSA-wq2g-r956-j8ccHigh

pg8000 SQL injection vulnerability via a specially crafted Python list input

Vendor

GitHub Security Advisories

Published

October 27, 2025

Last Modified

October 27, 2025

🔗 CVE IDs covered (1)

CVE-2025-61385 →

📋 Description

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

🎯 Affected products1

pip/pg8000:<= 1.31.4

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-61385
https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140
https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385
https://github.com/advisories/GHSA-wq2g-r956-j8cc