CVE-2025-65896

Vulnerability

Description asyncmy, an asyncio MySQL/MariaDB driver, contains a SQL injection vulnerability in versions up to 0.2.10. The flaw resides in the escape_dict function within converters.pyx, where only dictionary values are escaped using escape_item, but dictionary keys are left unescaped [1][3]. This oversight allows an attacker to inject arbitrary SQL commands by providing crafted dict keys.

Exploitation

An attacker can exploit this by controlling the keys of a dictionary passed to a query. For example, if a dict is used in a SQL statement, the key string is inserted directly into the query without sanitization. The attacker does not need authentication if the vulnerable code path is exposed to user input. The attack vector is through network requests that supply such malicious dicts [3].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands on the database. This can lead to data exfiltration, modification, or deletion, and in some cases, full compromise of the database server.

Mitigation

The maintainer has likely addressed this in versions after 0.2.10 (e.g., 0.2.12). Users should upgrade to the latest version. No official advisory or fix was found in the provided references, but the issue #134 documents the problem [3].