CVE-2024-36039
PyMySQL SQL Injection vulnerability
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
CVE-2024-36039- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2024-1798
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
EUVD-2024-1798- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v9hf-5j83-6xpp
PyMySQL SQL Injection vulnerability
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
GHSA-v9hf-5j83-6xpp- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
CVE-2024-36039- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
CVE-2024-36039- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-36039
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
DEBIAN-CVE-2024-36039- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 24 moreShow less
OSVGHSA-v9hf-5j83-6xpp
PyMySQL SQL Injection vulnerability
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
GHSA-v9hf-5j83-6xpp- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVOESA-2024-1719
python-PyMySQL security update
This package contains a pure-Python MySQL client library, based on PEP 249. Most public APIs are compatible with mysqlclient and MySQLdb.
Security Fix(es):
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.(CVE-2024-36039)
- Record
OESA-2024-1719- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2026-502
PyMySQL SQL Injection vulnerability
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
PYSEC-2026-502- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:4244
Red Hat Security Advisory: python3.11-PyMySQL security update
- Record
RHSA-2024:4244- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:4245
Red Hat Security Advisory: python3 security update
- Record
RHSA-2024:4245- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:9193
Red Hat Security Advisory: python3.12-PyMySQL security update
- Record
RHSA-2024:9193- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:9194
Red Hat Security Advisory: python3.11-PyMySQL security update
- Record
RHSA-2024:9194- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRLSA-2024:4244
Moderate: python3.11-PyMySQL security update
This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.
Security Fix(es):
- python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.
- Record
RLSA-2024:4244- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRLSA-2024:4245
Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
- python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2024:4245- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRLSA-2024:9193
Moderate: python3.12-PyMySQL security update
This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.
Security Fix(es):
- python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.
- Record
RLSA-2024:9193- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-36039
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
UBUNTU-CVE-2024-36039- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVALSA-2024:4244 No score
Moderate: python3.11-PyMySQL security update
This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.
Security Fix(es):
- python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.
- Record
ALSA-2024:4244- Updated
- 2026-11-02
OSVALSA-2024:4245 No score
Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
- python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2024:4245- Updated
- 2026-11-02
OSVALSA-2024:9193 No score
Moderate: python3.12-PyMySQL security update
This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.
Security Fix(es):
- python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:9193- Updated
- 2026-11-02
OSVALSA-2024:9194 No score
Moderate: python3.11-PyMySQL security update
This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.
Security Fix(es):
- python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:9194- Updated
- 2026-11-02
OSVAZL-43726 No score
CVE-2024-36039 affecting package python-PyMySQL 0.9.3-3
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
AZL-43726- Updated
- 2026-11-02
OSVAZL-44457 No score
CVE-2024-36039 affecting package python-PyMySQL for versions less than 1.1.1-3
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
- Record
AZL-44457- Updated
- 2026-11-02
OSVCLSA-2026-1768435940 No score
TuxCare security update for pymysql (1 CVE)
TuxCare rebuilt pymysql to address 1 CVE. Fixed in 0.10.1.post1+tuxcare.
- Record
CLSA-2026-1768435940- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13993-1 No score
python310-PyMySQL-1.1.1-1.1 on GA media
These are all security issues fixed in the python310-PyMySQL-1.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13993-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11995-1 No score
python313-PyMySQL-1.2.0-1.2 on GA media
These are all security issues fixed in the python313-PyMySQL-1.2.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11995-1- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2024-36039 No score
CVE-2024-36039 in rootio-PyMySQL - Patched by Root
Root has patched CVE-2024-36039 in the rootio-PyMySQL package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2024-36039- Updated
- 2026-11-02
OSVSUSE-SU-2024:1855-1 No score
Security update for python-PyMySQL
This update for python-PyMySQL fixes the following issues:
- CVE-2024-36039: Fixed SQL injection if used with untrusted JSON input (bsc#1225070).
- Record
SUSE-SU-2024:1855-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1925-1 No score
Security update for python-PyMySQL
This update for python-PyMySQL fixes the following issues:
- CVE-2024-36039: Fixed SQL injection when used with untrusted JSON input (bsc#1225070).
- Record
SUSE-SU-2024:1925-1- Updated
- 2026-11-02
OSVUSN-6801-1 No score
python-pymysql vulnerability
It was discovered that PyMySQL incorrectly escaped untrusted JSON input. An attacker could possibly use this issue to perform SQL injection attacks.
- Record
USN-6801-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pymysqlPyPI |
before 1.1.1 | 1.1.1 |
python3.11-PyMySQLAlmaLinux:8 |
before 1.0.2-2.el8_10 | 1.0.2-2.el8_10 |
python3.12-PyMySQLAlmaLinux:8 |
before 1.1.0-3.el8_10 | 1.1.0-3.el8_10 |
python3.12-PyMySQLAlmaLinux:9 |
before 1.1.0-3.el9 | 1.1.0-3.el9 |
python3.12-PyMySQL+rsaAlmaLinux:9 |
before 1.1.0-3.el9 | 1.1.0-3.el9 |
python3.11-PyMySQLAlmaLinux:9 |
before 1.0.2-2.el9 | 1.0.2-2.el9 |
python3.11-PyMySQL+rsaAlmaLinux:9 |
before 1.0.2-2.el9 | 1.0.2-2.el9 |
python-PyMySQLAzure Linux:2 |
through 0.9.3-3 | None known |
python-PyMySQLAzure Linux:3 |
before 1.1.1-3 | 1.1.1-3 |
pymysqlTuxCare:PyPI |
0.10.1 up to 0.10.1.post1+tuxcare | 0.10.1.post1+tuxcare |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-pymysqlDebian:12 |
before 1.0.2-2+deb12u1, plus listed versions 1.0.2-2 |
1.0.2-2+deb12u1 |
python-pymysqlDebian:13 |
before 1.1.1-1 | 1.1.1-1 |
python-pymysqlDebian:14 |
before 1.1.1-1 | 1.1.1-1 |
python-pymysqlDebian:10 |
before 0.9.3-1+deb10u1, plus listed versions 0.9.3-1 |
0.9.3-1+deb10u1 |
python-pymysqlDebian:11 |
before 0.9.3-2+deb11u1, plus listed versions 0.9.3-2 |
0.9.3-2+deb11u1 |
pymysqlPyPI |
before 1.1.1, plus listed versions 0.10.00.10.10.20.30.4 Show 37 moreShow less0.50.60.6.10.6.20.6.2-rc10.6.30.6.40.6.4.dev10.6.50.6.60.6.70.7.00.7.10.7.100.7.110.7.20.7.30.7.40.7.50.7.60.7.70.7.80.7.90.8.00.8.10.9.00.9.10.9.20.9.31.0.01.0.11.0.21.0.31.0.3rc11.1.01.1.0rc11.1.0rc2 |
1.1.1 |
python-PyMySQLopenEuler:20.03-LTS-SP4 |
before 0.9.2-4.oe2003sp4 | 0.9.2-4.oe2003sp4 |
python-PyMySQLopenEuler:22.03-LTS-SP1 |
before 0.9.3-4.oe2203sp1 | 0.9.3-4.oe2203sp1 |
python-PyMySQLopenEuler:22.03-LTS-SP3 |
before 0.9.3-4.oe2203sp3 | 0.9.3-4.oe2203sp3 |
python-PyMySQLopenEuler:24.03-LTS |
before 1.1.0-2.oe2403 | 1.1.0-2.oe2403 |
python3.11-PyMySQLRed Hat:enterprise_linux:8::appstream |
before 0:1.0.2-2.el8_10 | 0:1.0.2-2.el8_10 |
python3.12-PyMySQLRed Hat:enterprise_linux:8::appstream |
before 0:1.1.0-3.el8_10 | 0:1.1.0-3.el8_10 |
python3.12-PyMySQL+rsaRed Hat:enterprise_linux:9::appstream |
before 0:1.1.0-3.el9 | 0:1.1.0-3.el9 |
python3.12-PyMySQLRed Hat:enterprise_linux:9::appstream |
before 0:1.1.0-3.el9 | 0:1.1.0-3.el9 |
python3.11-PyMySQL+rsaRed Hat:enterprise_linux:9::appstream |
before 0:1.0.2-2.el9 | 0:1.0.2-2.el9 |
python3.11-PyMySQLRed Hat:enterprise_linux:9::appstream |
before 0:1.0.2-2.el9 | 0:1.0.2-2.el9 |
python3.11-PyMySQLRocky Linux:8 |
before 0:1.0.2-2.el8_10 | 0:1.0.2-2.el8_10 |
python3.12-PyMySQLRocky Linux:8 |
before 0:1.1.0-3.el8_10 | 0:1.1.0-3.el8_10 |
python3.12-PyMySQLRocky Linux:9 |
before 0:1.1.0-3.el9 | 0:1.1.0-3.el9 |
rootio-PyMySQLRoot:PyPI |
before 1.1.0+root.io.1 | 1.1.0+root.io.11.1.0+root.io.2 |
PyMySQLRoot:PyPI |
before 1.1.0+aikido.2 | 1.1.0+aikido.2 |
python-PyMySQLSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 0.7.11-150000.3.3.1 | 0.7.11-150000.3.3.1 |
python-PyMySQLSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 0.7.11-150000.3.3.1 | 0.7.11-150000.3.3.1 |
python-PyMySQLopenSUSE:Leap 15.5 |
before 0.7.11-150000.3.3.1 | 0.7.11-150000.3.3.1 |
python-PyMySQLopenSUSE:Leap 15.6 |
before 1.1.0-150600.3.3.1 | 1.1.0-150600.3.3.1 |
python-pymysqlUbuntu:16.04:LTS |
All versions, plus listed versions 0.6.2-20.7.2-10.7.2-1ubuntu1 |
None known |
python-pymysqlUbuntu:18.04:LTS |
All versions, plus listed versions 0.7.11-10.8.0-1 |
None known |
python-pymysqlUbuntu:20.04:LTS |
before 0.9.3-2ubuntu3.1, plus listed versions 0.9.3-10.9.3-2ubuntu10.9.3-2ubuntu3 |
0.9.3-2ubuntu3.1 |
python-pymysqlUbuntu:22.04:LTS |
before 1.0.2-1ubuntu1.22.04.1, plus listed versions 1.0.2-1ubuntu1 |
1.0.2-1ubuntu1.22.04.1 |
python-pymysqlUbuntu:24.04:LTS |
before 1.0.2-2ubuntu1.1, plus listed versions 1.0.2-1ubuntu11.0.2-2ubuntu1 |
1.0.2-2ubuntu1.1 |
python-PyMySQLopenSUSE:Tumbleweed |
before 1.2.0-1.2 | 1.2.0-1.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | zenniskayy2k4/CVE-2024-36039_PoC | 2026-03-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-36039 is a medium vulnerability (CVSS 6.3) in pymysql, published May 21, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in pymysql 1.1.1.
References
github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1
lists.debian.org/debian-lts-announce/2024/05/msg00017.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK
nvd.nist.gov/vuln/detail/CVE-2024-36039
Show 33 moreShow less
access.redhat.com/errata/RHSA-2024:4244
bugzilla.redhat.com/2282821
errata.almalinux.org/8/ALSA-2024-4244.html
security-tracker.debian.org/tracker/CVE-2024-36039
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1719
pypi.org/project/pymysql
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4244.json
cve.org/CVERecord?id=CVE-2024-36039
docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
errata.rockylinux.org/RLSA-2024:4244
suse.com/support/update/announcement/2024/suse-su-20241855-1
bugzilla.suse.com/1225070
ubuntu.com/security/CVE-2024-36039