Executive brief
SQLAlchemy is a widely-used Python library for database access and object-relational mapping. A SQL injection vulnerability in the group_by parameter allows attackers to execute arbitrary SQL commands if application code passes untrusted user input directly to this parameter. This could lead to unauthorized data access, modification, or deletion in connected databases.
Technical details
SQLAlchemy 1.2.17 and earlier versions are vulnerable to SQL injection through the group_by parameter when it accepts unvalidated string input. The vulnerability is rooted in insufficient input sanitization that allows attacker-controlled text to be directly concatenated into SQL queries. The attack vector is network-reachable if the vulnerable code is part of a web application, and no authentication is required—only that untrusted input reaches the group_by parameter. An attacker can craft malicious SQL fragments to bypass intended query logic, extract sensitive data, or manipulate database state. The vulnerability was patched in SQLAlchemy 1.2.19; users should upgrade immediately.
Affected products
- SQLAlchemy SQLAlchemy 0.1.0 through 1.2.18
Timeline
- 2019-02-06: disclosed
- 2019-04-16: advisory
- 2019: patched: Fixed in SQLAlchemy 1.2.19