What’s Vulnerable › Vulnerabilities

CVE-2024-24811: Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-07 · updated 2026-06-17
• Weakness: CWE-89

Description

SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.

Affected products

• zopefoundation Products.SQLAlchemyDA: before 2.2 — fixed in 2.2

How to fix

Upgrade to a fixed version: zopefoundation Products.SQLAlchemyDA 2.2. Check the vendor advisory for mitigations.

References

• https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a
• https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw
• https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a
• https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw

Get alerted when CVE-2024-24811 or the next vulnerability affects your stack