GitHub Advisoryadvisory · PyPI

GHSA-887w-45rq-vxgf SQLAlchemy vulnerable to SQL Injection via order_by parameter

CRITICAL Published 2019-04-16 Modified 2026-06-09 Official page ↗
Aliases
CVE-2019-7164
Ecosystem
PyPI
Packages
SQLAlchemy
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• PyPI SQLAlchemy: < 1.3.0b3 → fixed in 1.3.0b3

Description

SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable.

Related

Alias · CVE (1)

  • CVE-2019-7164 SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References