{"action":"Upgrade sqlalchemy to 1.3.0b3 or later.","affected":[{"fixed":"1.3.0b3","introduced":"0"}],"component":"sqlalchemy","cve_ids":["CVE-2019-7164"],"ecosystem":"PyPI","epss":0.03525,"exploited":false,"fixed_versions":["1.3.0b3"],"ghsa_id":"GHSA-887w-45rq-vxgf","id":"tcs_01M5KF7PFJPT63G070R74BWF5Q","modified_at":"2026-06-09T18:41:13Z","published_at":"2019-04-16T15:50:41Z","references":["https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf","https://nvd.nist.gov/vuln/detail/CVE-2019-7164","https://github.com/sqlalchemy/sqlalchemy/issues/4481","https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0984","https://github.com/advisories/GHSA-887w-45rq-vxgf","https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2019-123.yaml","https://github.com/sqlalchemy/sqlalchemy","https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html","https://www.oracle.com/security-alerts/cpujan2021.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-887w-45rq-vxgf","url":"https://osv.dev/vulnerability/GHSA-887w-45rq-vxgf"}],"summary":"SQLAlchemy vulnerable to SQL Injection via order_by parameter"}