{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.8.1","last_affected":"4.0"}],"component":"pygresql","cve_ids":["CVE-2009-2940"],"ecosystem":"PyPI","epss":0.02702,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xv6x-43gq-4hfj","id":"tcs_01M5KG57F82VTX6RKYR47HCEQK","modified_at":"2026-06-10T17:01:44.540836585Z","published_at":"2009-10-22T16:30:00.250Z","references":["https://osv.dev/vulnerability/PYSEC-2009-18","http://ubuntu.com/usn/usn-870-1","http://www.osvdb.org/59028","http://secunia.com/advisories/37046","http://secunia.com/advisories/37654","http://www.debian.org/security/2009/dsa-1911","https://github.com/advisories/GHSA-xv6x-43gq-4hfj"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2009-18","url":"https://osv.dev/vulnerability/PYSEC-2009-18"}],"summary":"The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character enc"}