CVE-2024-36039

A SQL injection vulnerability was found in PyMySQL when used with untrusted JSON input, as keys are not properly escaped by escape_dict. This flaw allows attackers to inject malicious SQL queries by exploiting the insufficient input sanitization in PyMySQL when processing JSON data. Successful exploitation of this vulnerability can result in unauthorized data access, data tampering, or potentially remote code execution on the backend database server, depending on the permissions granted to the database user.