Sqlalchemy

3 CVEs across 2 Sqlalchemy products. Browse Sqlalchemy vulnerabilities, severities, and proof-of-concept exploits.

Sqlalchemy products with known CVEs

ProductCVEs
Mako3
Sqlalchemy3
Sqlalchemy CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-443072026-05-12Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory tra…
CVE-2026-41205High7.52026-04-23Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., /…
CVE-2022-40023High7.52022-09-07Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and lingu…
CVE-2019-7164Critical9.82019-02-20SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
CVE-2019-7548High7.82019-02-06SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
CVE-2012-08052012-06-05Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1)…