CVE-2019-7164: SQL Injection in SQLAlchemy
Summary
CVE-2019-7164: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. Affects sqlalchemy versions < 1.2.18. Fixed in 1.2.18. How to fix ↓
Also tracked for
- sqlalchemy · Debian:11
The same CVE-2019-7164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, allowing developers to write SQL queries in a more Pythonic way. However, versions 1.2.17 and 1.3.x through 1.3.0b2 of SQLAlchemy are vulnerable to SQL Injection attacks when the 'order_by' parameter is not properly sanitized. This vulnerability can be exploited by an attacker to execute arbitrary SQL statements, potentially leading to unauthorized data access or modification.
Vulnerability Detail
The vulnerability (CVE-2019-7164) in SQLAlchemy arises due to inadequate input validation and sanitization of the 'order_by' parameter. An attacker can craft a malicious input that includes SQL code, which will be executed by the database server when the query is executed. This can result in various consequences, such as data leakage, data manipulation, or even complete compromise of the database. It is important to note that this vulnerability affects versions 1.2.17 and 1.3.x through 1.3.0b2 of SQLAlchemy.
How To Fix
Latest published version: 2.1.6 as of 23 Oct 2026
pip install --upgrade "sqlalchemy==2.1.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.18
This is the first release that contains the fix.
pip install --upgrade "sqlalchemy==1.2.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of SQLAlchemy is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the 'order_by' parameter before passing it to the SQLAlchemy API. This can be done by using parameterized queries or by using SQLAlchemy's built-in mechanisms for sanitizing user input. Here is an example of how to sanitize the 'order_by' parameter using parameterized queries:
from sqlalchemy import create_engine, text
engine = create_engine('your_database_connection_string')
order_by = request.args.get('order_by')
# Sanitize the 'order_by' parameter
sanitized_order_by = text(order_by)
# Execute the query with the sanitized parameter
result = engine.execute('SELECT * FROM your_table ORDER BY :order_by', order_by=sanitized_order_by)
Conclusion
In conclusion, the vulnerability (CVE-2019-7164) in SQLAlchemy allows for SQL Injection attacks when the 'order_by' parameter is not properly sanitized. It is crucial to upgrade to SQLAlchemy version 1.2.18 or later to mitigate this vulnerability. If immediate upgrade is not possible, implementing a temporary workaround by manually sanitizing the 'order_by' parameter can provide some protection. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for sqlalchemy →
FAQ
SQLAlchemy is a Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, allowing developers to write SQL queries in a more Pythonic way.
SQL Injection is a type of security vulnerability that occurs when an attacker is able to manipulate SQL queries executed by an application. By injecting malicious SQL code, the attacker can perform unauthorized actions on the database, such as accessing or modifying data.
This vulnerability in SQLAlchemy allows an attacker to execute arbitrary SQL statements, potentially leading to unauthorized data access or modification. Depending on the privileges of the database user used by the application, the impact can range from data leakage to complete compromise of the database.
Versions 1.2.17 and 1.3.x through 1.3.0b2 of SQLAlchemy are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file of your application.
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
