SQL Injection Affecting rococo package, versions [,1.1.11)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-ROCOCO-14894357
- published7 Jan 2026
- disclosed1 Jan 2026
- creditUnknown
Introduced: 1 Jan 2026
CVE NOT AVAILABLE CWE-89 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade rococo to version 1.1.11 or higher.
Overview
rococo is an A Python library to help build things the way we want them built
Affected versions of this package are vulnerable to SQL Injection due to improper handling of user-supplied pagination parameters. An attacker can exploit this by supplying crafted pagination values containing malicious SQL fragments, allowing unintended SQL execution that may lead to unauthorized data access, data manipulation, or database compromise.