Recommended action

Update PyGreSQL to 4.1 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection affects PyGreSQL (pip), PyGreSQL (pip). Severity is high. PyGreSQL 3.8 did not use PostgreSQL’s safe `string` and `bytea` functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, `pg.escape_string()` and `pg.escape_bytea()` are still available, but applications will have to be adjusted to use the new `pyobj.escape_string()` and `pyobj.escape_bytea()` functions. For example, code containing: ```python import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input) ``` should be adjusted to use: ```python import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input) ```

AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update PyGreSQL to 4.1 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection affects PyGreSQL (pip), PyGreSQL (pip). Severity is high. PyGreSQL 3.8 did not use PostgreSQL’s safe `string` and `bytea` functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, `pg.escape_string()` and `pg.escape_bytea()` are still available, but applications will have to be adjusted to use the new `pyobj.escape_string()` and `pyobj.escape_bytea()` functions. For example, code containing: ```python import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input) ``` should be adjusted to use: ```python import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input) ```

AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software