CVE-2019-7548: SQL Injection in SQLAlchemy
Summary
PYSEC-2019-54: SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. Affects sqlalchemy versions < 1.2.18. Fixed in 1.2.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, making it easier to work with SQL databases in Python. However, SQLAlchemy version 1.2.17 is vulnerable to SQL Injection when the 'group_by' parameter can be controlled.
Vulnerability Detail
The vulnerability in SQLAlchemy allows an attacker to inject malicious SQL queries when the 'group_by' parameter is not properly sanitized. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which the vulnerable code is used. It is important to note that this vulnerability affects SQLAlchemy version 1.2.17 and prior versions.
How To Fix
Latest published version: 2.1.6 as of 23 Oct 2026
pip install --upgrade "sqlalchemy==2.1.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.18
This is the first release that contains the fix.
pip install --upgrade "sqlalchemy==1.2.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
SQLAlchemy version 1.2.17 is vulnerable to SQL Injection when the 'group_by' parameter can be controlled. To mitigate this vulnerability, it is crucial to upgrade SQLAlchemy to version 1.2.18 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for sqlalchemy →
FAQ
The vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it for any open-source vulnerabilities, including this one.
Currently, there are no known workarounds for this vulnerability. It is recommended to upgrade SQLAlchemy to the latest version to fix the issue.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is crucial to patch the vulnerability as soon as possible to prevent any potential attacks.
This vulnerability was discovered and reported by the PyPA Advisory Database. More details can be found at the source link: https://github.com/pypa/advisory-database/blob/main/vulns/sqlalchemy/PYSEC-2019-54.yaml
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
