# CVE-2019-7548: PYSEC-2019-124 - SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

Source: https://junglewise.ai/threats/cve-2019-7548-sqlalchemy-sql-injection-in-group-by-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2019-7548 · Severity: low · CVSS 3 · Published 2019-02-06

SQLAlchemy is a widely-used Python library for database access and object-relational mapping. A SQL injection vulnerability in the group_by parameter allows attackers to execute arbitrary SQL commands if application code passes untrusted user input directly to this parameter. This could lead to unauthorized data access, modification, or deletion in connected databases.

Technologies: [SQLAlchemy (PyPI)](https://junglewise.ai/threats/technologies/sqlalchemy). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2019-7548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-7548 being exploited in the wild.

**How severe is CVE-2019-7548?** Low severity, with a CVSS score of 3, published 6 February 2019.

**Which products and versions are affected?** SQLAlchemy (PyPI) ECOSYSTEM:introduced=0,fixed=1.2.18, ECOSYSTEM:introduced=0,fixed=1.2.19.

**Is there a fix for CVE-2019-7548?** Yes. SQLAlchemy (PyPI): upgrade to 1.2.18, 1.2.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-7548 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-7548?** Check whether you run SQLAlchemy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- SQLAlchemy (PyPI): upgrade to 1.2.18, 1.2.19 or later

  ```sh
  pip install "SQLAlchemy>=1.2.19"
  ```


## Technical details

SQLAlchemy 1.2.17 and earlier versions are vulnerable to SQL injection through the group_by parameter when it accepts unvalidated string input. The vulnerability is rooted in insufficient input sanitization that allows attacker-controlled text to be directly concatenated into SQL queries. The attack vector is network-reachable if the vulnerable code is part of a web application, and no authentication is required—only that untrusted input reaches the group_by parameter. An attacker can craft malicious SQL fragments to bypass intended query logic, extract sensitive data, or manipulate database state. The vulnerability was patched in SQLAlchemy 1.2.19; users should upgrade immediately.

## Affected products

- SQLAlchemy SQLAlchemy 0.1.0 through 1.2.18

## Identifiers

- CVE-2019-7548
- GHSA-38fc-9xqv-7f7q
- PYSEC-2019-124

## Timeline

- 2019-02-06: disclosed
- 2019-04-16: advisory
- 2019: patched: Fixed in SQLAlchemy 1.2.19

## References

- [https://github.com/sqlalchemy/sqlalchemy/issues/4481](https://github.com/sqlalchemy/sqlalchemy/issues/4481)

## Related threats

- [SQLAlchemy vulnerable to SQL Injection via order_by parameter](https://junglewise.ai/threats/cve-2019-7164-sqlalchemy-vulnerable-to-sql-injection-via-order-by-parameter)
- [PYSEC-2019-53 - SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.](https://junglewise.ai/threats/pysec-2019-53-sqlalchemy-through-1-2-17-and-1-3-x-through-1-3-0b2-6bad9589)
- [PYSEC-2019-54 - SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.](https://junglewise.ai/threats/pysec-2019-54-sqlalchemy-1-2-17-has-sql-injection-when-the-group-by-c13f4d60)
- [SQLAlchemy vulnerable to SQL injection](https://junglewise.ai/threats/cve-2012-0805-sqlalchemy-vulnerable-to-sql-injection)