CVE-2025-65896: 
Python vulnerability analysis and mitigation

CVE-2025-65896 is a SQL injection vulnerability in asyncmy, a fast asyncio MySQL/MariaDB driver for Python developed by long2ice. The flaw affects all versions through 0.2.10 (and per the GitHub Advisory, through 0.2.11) and allows attackers to execute arbitrary SQL commands by supplying crafted dictionary keys. It was published on December 2, 2025, with the GitHub Advisory Database entry reviewed on December 3, 2025. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Feedly).

The root cause (CWE-89) mirrors a previously disclosed vulnerability in PyMySQL (CVE-2024-36039): the escape_dict function in asyncmy's Cython-compiled converters.pyx escapes only dictionary values, leaving dictionary keys unsanitized and directly interpolated into SQL queries (asyncmy Issue #134). The vulnerable code block is:

cpdef dict escape_dict(dict val, str charset, mapping: dict = None):
    n = {}
    for k, v in val.items():
        quoted = escape_item(v, charset, mapping)
        n[k] = quoted
    return n

An attacker who can control dictionary keys passed to parameterized query helpers can inject arbitrary SQL syntax without authentication, exploiting the library over the network with low complexity and no user interaction required (Github Advisory, asyncmy Issue #134).

Successful exploitation grants an attacker the ability to execute arbitrary SQL commands against the backend MySQL or MariaDB database, resulting in high impacts to confidentiality, integrity, and availability. An attacker could read, modify, or delete sensitive data, potentially drop tables or entire databases, and — depending on database user privileges — escalate to operating system command execution via features such as INTO OUTFILE or LOAD_FILE. Applications using asyncmy that accept user-controlled input as dictionary keys are fully exposed to unauthorized data access and potential lateral movement into backend infrastructure (Github Advisory, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been published and there is no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036% (11th percentile), indicating a currently low probability of near-term exploitation (Github Advisory). However, the unauthenticated, network-accessible attack vector and critical CVSS score make it a high-priority patching target.

1. Identify target applications: Locate Python web applications or services that use asyncmy version ≤ 0.2.10/0.2.11 as their MySQL/MariaDB driver and accept user-controlled input that is passed as dictionary keys to database query methods.
2. Craft malicious dictionary keys: Construct a Python dictionary where the key contains SQL injection payloads (e.g., {"col1 UNION SELECT password FROM users-- ": "value"}), exploiting the fact that escape_dict` only escapes values, not keys.
3. Submit the payload: Deliver the crafted dictionary through the application's input surface (e.g., API parameters, form fields, JSON body) that is processed and passed to asyncmy's query execution path.
4. Execute arbitrary SQL: The unsanitized key is interpolated directly into the SQL statement, causing the database to execute the injected command — enabling data exfiltration, data manipulation, or further privilege escalation depending on the database account's permissions (asyncmy Issue #134, Github Advisory).

• Logs: Unusual or malformed SQL queries in MySQL/MariaDB general query logs containing SQL keywords (e.g., UNION, SELECT, DROP, INSERT, --) embedded within column name positions rather than value positions.
• Network: Unexpected outbound connections from the database server (potential sign of INTO OUTFILE or UDF-based OS command execution following SQL injection).
• Application Logs: Python application error logs showing unexpected SQL syntax errors or anomalous query structures involving dictionary key fields.
• Database: Unexpected new tables, files written to the filesystem via SELECT INTO OUTFILE, or new database user accounts created without authorization.

The GitHub Advisory notes that no patched version was available at the time of initial publication (affected versions listed as ≤ 0.2.11); however, the asyncmy repository has since released v0.2.12 and later, which include performance and security improvements — users should upgrade to the latest available release (asyncmy GitHub). As an immediate workaround, developers should validate and sanitize all dictionary keys before passing them to asyncmy query methods, and avoid using user-controlled input as dictionary keys in database operations. Using parameterized queries with positional placeholders rather than dictionary-based escaping is the recommended long-term architectural mitigation (Github Advisory, asyncmy Issue #134).

The vulnerability was reported by security researcher jfsoden and disclosed via GitHub Issue #134 on July 26, 2025, explicitly noting the parallel to CVE-2024-36039 in PyMySQL, which shares the same root cause in its escape_dict implementation (asyncmy Issue #134). German Linux security outlet pro-linux.de covered the vulnerability in June 2026, and it was included in a monthly CVE threat report for December 2025, indicating moderate community awareness. No major vendor statements or widespread social media discussion have been identified beyond standard vulnerability database aggregation.