CVE-2025-61385: pg8000 SQL Injection Vulnerability via Crafted Python List Input
Summary
CVE-2025-61385: pg8000 SQL injection vulnerability via a specially crafted Python list input. Affects pg8000 versions < 1.31.5. Fixed in 1.31.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pg8000 is a pure-Python PostgreSQL driver that allows Python applications to connect to PostgreSQL databases. It is designed to be simple and easy to use, providing a straightforward interface for executing SQL commands and managing database connections. However, a recent vulnerability has been identified that exposes users to SQL injection attacks, which can lead to unauthorized access and manipulation of database information.
Vulnerability Detail
The vulnerability in pg8000 version 1.31.4 arises from improper handling of user input in the function pg8000.native.literal. Specifically, when a specially crafted Python list is passed as input, it can allow remote attackers to execute arbitrary SQL commands. This SQL injection vulnerability can lead to severe consequences, including data leakage, data corruption, and unauthorized access to sensitive information stored in the database.
How To Fix
Latest published version: 1.31.5 as of 23 Oct 2026
pip install --upgrade "pg8000==1.31.5"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted or user-controlled input directly to the pg8000.native.literal function. Instead, validate and sanitize inputs before processing them to mitigate the risk of SQL injection.
Conclusion
The SQL injection vulnerability identified in pg8000 version 1.31.4 poses significant risks to applications using this package. It is crucial for developers to upgrade to version 1.31.5 or later to mitigate these risks. Additionally, implementing input validation and sanitization can help protect against potential attacks until an upgrade can be performed.
See every vulnerability recorded for pg8000 →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by inserting or 'injecting' malicious SQL statements into an entry field for execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to the database, data manipulation, data leakage, and overall compromise of the application's integrity.
Using pg8000 version 1.31.4 is not safe due to the identified SQL injection vulnerability. It is strongly recommended to upgrade to version 1.31.5 or later.
If you cannot upgrade immediately, ensure that you validate and sanitize all user inputs to prevent SQL injection attacks as a temporary measure.
