CVE-2024-9774

What it actually does

Unary operators in python-sql fail to escape non-Expression objects, permitting injection of arbitrary SQL syntax into generated queries.

Why it matters to the business

Attackers can read or modify sensitive database contents, resulting in data breaches, integrity loss, and compliance violations with moderate urgency given low EPSS and absence from KEV.

How an attack unfolds

An authenticated attacker supplies malicious input containing unary operators combined with SQL fragments; the library omits escaping for non-Expression values, allowing the fragments to alter the executed query structure.

How to fix it

Upgrade python-sql to a patched release that ensures escaping for all operands in unary operators; adopt parameterized queries and strict input validation as defense-in-depth.

How to confirm the fix worked

Inspect source for unary operator usage, replay test cases with non-Expression inputs, and confirm that injected fragments no longer appear in generated SQL.

Typical attack path

1. Locate application code paths that pass user-controlled values to unary operators in python-sql
2. Craft payload using unary operator syntax plus injected SQL clauses
3. Submit payload through normal application interfaces
4. Observe or leverage results of the modified database query

How to detect it

Review application and database logs for unexpected SQL syntax or clauses that match patterns typical of unary operator misuse; correlate with application input sources.

What your security team should do

• Audit all direct and transitive uses of python-sql across the environment
• Apply library updates and retest query generation paths
• Enable detailed database query logging to detect anomalous statements