CVE-2025-65896: asyncmy SQL Injection Vulnerability via Crafted Dict Keys
Summary
CVE-2025-65896: assyncmy is vulnerable to SQL injection via crafted dict keys. Affects asyncmy versions < 0.2.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
asyncmy is a Python library designed for asynchronous MySQL database interactions. It allows developers to perform non-blocking database operations, enhancing the performance of applications that require high concurrency. However, the library has a critical vulnerability that exposes it to SQL injection attacks, which can lead to unauthorized access and manipulation of the database.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the asyncmy library, specifically in versions up to 0.2.10. Attackers can exploit this flaw by crafting specific dictionary keys that are processed by the library, allowing them to execute arbitrary SQL commands. This can lead to data breaches, data loss, or complete control over the database, making it a severe security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using user-generated input directly in SQL queries. Implement input validation and sanitization to mitigate the risk of SQL injection until the package can be updated.
Conclusion
The asyncmy library has a critical SQL injection vulnerability that can be exploited through crafted dictionary keys. It is essential to update to a patched version to protect your application from potential attacks. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for asyncmy →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by inserting malicious SQL statements into an entry field for execution.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
The consequences include unauthorized access to sensitive data, data manipulation, and potential complete control over the database, which can lead to significant data breaches.
Yes, a patch is available. Update the asyncmy package to a version later than 0.2.10 to mitigate the vulnerability.
Vulert uses the Pipfile.lock to monitor and alert in real-time for open-source vulnerabilities in your software, helping you maintain security without needing to access the code directly.
