CVE-2019-7164: SQLAlchemy SQL Injection Vulnerability
Summary
CVE-2019-7164: SQLAlchemy vulnerable to SQL Injection via order_by parameter. Affects sqlalchemy across 2 version ranges.
< 1.2.18
>= 1.3.0b1, < 1.3.0b3
Fixed in 1.2.18 or 1.3.0b3, depending on the release line you run. How to fix ↓
Also tracked for
- sqlalchemy · Debian:11
The same CVE-2019-7164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, allowing developers to write SQL queries using Python syntax. SQLAlchemy is widely used in various Python applications and frameworks. However, versions 1.2.17 and 1.3.x through 1.3.0b2 of SQLAlchemy are vulnerable to an SQL Injection attack.
Vulnerability Detail
The vulnerability, identified as CVE-2019-7164, stems from improper neutralization of special elements used in an SQL command. Specifically, the 'order_by' parameter in SQLAlchemy is susceptible to SQL Injection. An attacker can exploit this vulnerability by injecting malicious SQL code into the 'order_by' parameter, potentially leading to unauthorized access, data manipulation, or even remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 2.1.6 as of 23 Oct 2026
pip install --upgrade "sqlalchemy==2.1.6"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.2.181.2.18pip install --upgrade "sqlalchemy==1.2.18" -
>= 1.3.0b1, < 1.3.0b31.3.0b3pip install --upgrade "sqlalchemy==1.3.0b3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of SQLAlchemy is not immediately feasible, a temporary workaround is to manually sanitize and validate the 'order_by' parameter before passing it to the affected functions. This can be done by using parameterized queries or input validation techniques to ensure that the parameter only contains valid and expected values.
Conclusion
In conclusion, the SQLAlchemy SQL Injection vulnerability (CVE-2019-7164) poses a significant risk to applications using affected versions of SQLAlchemy. It is crucial to upgrade to the latest version or apply appropriate input validation to mitigate the risk of SQL Injection attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlalchemy →
FAQ
SQLAlchemy is a Python SQL toolkit and Object-Relational Mapping (ORM) library that provides a set of high-level API for interacting with databases.
SQL Injection is a type of security vulnerability that allows an attacker to manipulate SQL queries by injecting malicious SQL code into input parameters, potentially leading to unauthorized access, data manipulation, or remote code execution.
If your application uses SQLAlchemy versions 1.2.17 or 1.3.x through 1.3.0b2 and allows user-controlled input to be used in the 'order_by' parameter, it may be vulnerable to SQL Injection attacks.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8, indicating a high risk of exploitation and potential impact on the confidentiality, integrity, and availability of the affected system.
To fix this vulnerability, it is recommended to upgrade SQLAlchemy to version 1.3.0 or later. Alternatively, you can manually sanitize and validate the 'order_by' parameter before passing it to the affected functions.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
