VYPR
← All advisories
Critical severityOSV Advisory· Published Feb 6, 2019· Updated Aug 4, 2024

CVE-2019-7548

CVE-2019-7548

Description

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SQLAlchemy 1.2.17 is vulnerable to SQL injection via the group_by parameter when user-controlled input is passed unsanitized.

Vulnerability

SQLAlchemy version 1.2.17 contains a SQL injection vulnerability in the group_by parameter. The issue arises when an application passes user-controlled input directly to the group_by() method without proper sanitization or parameterization. The vulnerable code path is reachable when the group_by argument is built from untrusted data, allowing an attacker to inject arbitrary SQL clauses. The affected versions include SQLAlchemy 1.2.17 and possibly earlier releases, as referenced in multiple advisories [1][2][3][4].

Exploitation

An attacker needs the ability to supply or influence the value of the group_by parameter in a SQLAlchemy query. No authentication is required if the application exposes a query interface to unauthenticated users. The concrete sequence involves crafting a malicious group_by string that includes SQL injection payloads, which then becomes part of the generated SQL statement. No special network position is required beyond normal web access to the vulnerable application [3][4].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the database. This can lead to unauthorized data disclosure, modification, or deletion, and in some contexts, compromise of the database server. The impact is limited to the privileges of the database user configured for the SQLAlchemy connection [3][4].

Mitigation

The fix was released in SQLAlchemy 1.2.18 and later. Users should upgrade to version 1.2.18 or newer. Red Hat also provided updated packages (e.g., python-sqlalchemy-1.3.2-1.module+el8.0.0+2975+e0f02136) as part of RHSA-2019:0981 and RHSA-2019:0984 [1][2]. If upgrading is not immediately possible, applications should sanitize or validate any user-supplied input before passing it to the group_by method [3][4].

References
  1. https://access.redhat.com/errata/RHSA-2019:0981
  2. https://access.redhat.com/errata/RHSA-2019:0984
  3. NVD - CVE-2019-7548
  4. CVE-2019-7548 - GitHub Advisory Database

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
SQLAlchemyPyPI
< 1.2.191.2.19

Affected products

154

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.