AIKIDO-2026-10678
pytest-mysql is vulnerable to OS Command Injection
55
Medium Risk
This Affects:
pytest-mysqlTL;DR
Affected versions of this package contain a command injection risk in pytest_mysql/executor.py, where multiple subprocess.check_output(..., shell=True) calls build shell command strings from user-controllable values such as executable paths, user names, and file paths. An attacker able to influence these inputs could inject shell metacharacters to execute arbitrary OS commands during MySQL initialization or shutdown. It may lead to unauthorized command execution, data tampering, or full compromise of the environment running the tests.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
pytest-mysql is vulnerable to OS Command Injection in versions 2.0.0 - 3.1.0.
How to fix this
Upgrade the pytest-mysql library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant