CVE-2012-0805: SQLAlchemy SQL Injection Vulnerability
Summary
CVE-2012-0805: SQLAlchemy vulnerable to SQL injection. Affects sqlalchemy versions < 0.7.0b4. Fixed in 0.7.0b4. How to fix ↓
Also tracked for
- sqlalchemy · Debian:11
The same CVE-2012-0805 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, allowing developers to write SQL queries in a more Pythonic way. SQLAlchemy is widely used in various projects and frameworks, including Keystone. However, versions before 0.7.0b4 of SQLAlchemy are vulnerable to SQL injection attacks.
Vulnerability Detail
The vulnerability in SQLAlchemy arises from multiple SQL injection vulnerabilities. Specifically, remote attackers can exploit these vulnerabilities to execute arbitrary SQL commands. The vulnerabilities can be triggered by using the 'limit' or 'offset' keyword in the select function, or by manipulating the 'select.limit' or 'select.offset' function. By crafting malicious input, an attacker can inject SQL commands into the application's database queries, potentially leading to unauthorized data access, data manipulation, or even remote code execution.
How To Fix
Latest published version: 2.1.6 as of 23 Oct 2026
pip install --upgrade "sqlalchemy==2.1.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.0b4
This is the first release that contains the fix.
pip install --upgrade "sqlalchemy==0.7.0b4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading SQLAlchemy is not immediately feasible, developers can implement input validation and parameterized queries to mitigate the risk of SQL injection attacks. By validating and sanitizing user input, and using parameterized queries or prepared statements, the application can prevent malicious SQL commands from being injected into the database queries. Here's an example of using parameterized queries with SQLAlchemy:
from sqlalchemy import create_engine, text
engine = create_engine('database://user:password@host:port/database')
query = text('SELECT * FROM users WHERE id = :user_id')
result = engine.execute(query, user_id=123)
Conclusion
In conclusion, SQLAlchemy versions before 0.7.0b4 are vulnerable to SQL injection attacks. It is crucial for developers to upgrade to the latest patched version of SQLAlchemy or implement appropriate mitigation measures, such as input validation and parameterized queries. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlalchemy →
FAQ
SQLAlchemy is a Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, allowing developers to write SQL queries in a more Pythonic way.
SQL injection is a type of security vulnerability where an attacker can insert malicious SQL commands into an application's database queries. This can lead to unauthorized data access, data manipulation, or even remote code execution.
The vulnerability can be exploited by crafting malicious input and using the 'limit' or 'offset' keyword in the select function, or by manipulating the 'select.limit' or 'select.offset' function in SQLAlchemy.
The potential consequences of the vulnerability include unauthorized data access, data manipulation, or even remote code execution. An attacker can exploit the vulnerability to execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of the application's data.
The vulnerability can be mitigated by upgrading SQLAlchemy to version 0.7.0b4 or later. Additionally, developers should implement input validation and use parameterized queries or prepared statements to prevent SQL injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
