SQLAlchemy is vulnerable to SQL Injection via group_by parameter
High severity
GitHub Reviewed
Published
Apr 16, 2019
to the GitHub Advisory Database
•
Updated Sep 1, 2023
Description
Published by the National Vulnerability Database
Feb 6, 2019
Published to the GitHub Advisory Database
Apr 16, 2019
Reviewed
Jun 16, 2020
Last updated
Sep 1, 2023
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
References