CVE-2023-47128: piccolo SQL Injection via named transaction savepoints
(updated )
The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection as user provided input is passed directly to connection.execute(...) via f-strings.
References
- github.com/advisories/GHSA-xq59-7jf3-rjc6
- github.com/piccolo-orm/piccolo
- github.com/piccolo-orm/piccolo/commit/82679eb8cd1449cf31d87c9914a072e70168b6eb
- github.com/piccolo-orm/piccolo/security/advisories/GHSA-xq59-7jf3-rjc6
- github.com/pypa/advisory-database/tree/main/vulns/piccolo/PYSEC-2023-241.yaml
- nvd.nist.gov/vuln/detail/CVE-2023-47128
Code Behaviors & Features
Detect and mitigate CVE-2023-47128 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →