{"action":"Upgrade sqlalchemy to 1.3.0b3 or later.","affected":[{"fixed":"1.3.0b3","introduced":"0"}],"component":"sqlalchemy","cve_ids":["CVE-2019-7164"],"ecosystem":"PyPI","epss":0.03496,"exploited":false,"fixed_versions":["1.3.0b3"],"ghsa_id":"GHSA-887w-45rq-vxgf","id":"tcs_01M5KG8EQZWK9PSJZFTHJ6TV2H","modified_at":"2026-06-09T17:00:05.645958339Z","published_at":"2019-02-20T00:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-123","https://github.com/sqlalchemy/sqlalchemy/issues/4481","https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html","https://access.redhat.com/errata/RHSA-2019:0984","https://access.redhat.com/errata/RHSA-2019:0981","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://github.com/advisories/GHSA-887w-45rq-vxgf"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2019-123","url":"https://osv.dev/vulnerability/PYSEC-2019-123"},{"source":"nvd","source_id":"CVE-2019-7164","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7164"}],"summary":"SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x ve"}