Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

aiomysql

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2PyPIAmendedPublished

    aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

    CVE-2025-62611 · GHSA-r397-ff8c-wv2g

    Affected
    • PyPI aiomysql <= 0.2.0
    Fixed in
    0.3.0· Vendor fix available
    Issue
    The client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. Details It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOADLOCAL instruction packet. Related to CVE-2019-2503. PoC First, start up a rogue MySQL server that ignores client-side flags and sends LOADLOCAL packet to the client – tested with https://github.com/rmb122/roguemysqlserver 1. Create a file to be stolen by the rogue server: echo "gotcha" /tmp/mysecretfile.txt 2. Clone the repo: git clone git@github.com:rmb122/roguemysqlserver.git && cd roguemysqlserver 3. Build the server: make roguemysqlserver 4. Generate a sample config: roguemysqlserver -generate 5. In config.yaml change filelist to ["/tmp/mysecretfile.txt"] 6. Run the server: ./roguemysqlserver -config config.yaml Next, the vulnerability can be seen in…

    Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →