9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65896

CVE-2025-65896: assyncmy is vulnerable to SQL injection via crafted dict keys

SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65896

CVE-2025-65896:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
asyncmy	pip	<= 0.2.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the asyncmy.converters module, specifically within the escape_dict function. This function is responsible for preparing Python dictionaries for use in SQL queries. The analysis of the source code for asyncmy/converters.pyx reveals that while dictionary values are properly escaped, the keys are not. The function escape_dict iterates over the dictionary items and applies escaping only to the values, leaving the keys untouched. This flaw can be exploited if an attacker can supply a dictionary with specially crafted keys, which will then be incorporated directly into the SQL query, leading to SQL injection. The escape_item function is also identified as vulnerable because it acts as a dispatcher, and when it receives a dictionary, it directs it to the flawed escape_dict function. The vulnerability is confirmed by the GitHub issue #134 in the long2ice/asyncmy repository, which explicitly points out this flaw. Since there is no patched version available yet, the code from the latest version serves as evidence of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.