SecOps #1124: [Sécurité] Vulnérabilité de code : scripts/sync_faiss_index.py:64 (python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query) - GetYourJob - Redmine

Actions

SecOps #1124

open

[Sécurité] Vulnérabilité de code : scripts/sync_faiss_index.py:64 (python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)

SecOps #1124: [Sécurité] Vulnérabilité de code : scripts/sync_faiss_index.py:64 (python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)

Added by Client Dashboard about 2 months ago. Updated 28 days ago.

Status:

Submitted

Priority:

Normal

Assignee:

Start date:

06/15/2026

Due date:

% Done:

Estimated time:

spec_ref:

build_status:

build_number:

ci_run_url:

scan_status:

scan_report_url:

deploy_status:

preprod_url:

deployed_at:

branch:

pr_url:

security_key:

scripts/sync_faiss_index.py:64_python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query

severity:

high

paused:

Description

**Sévérité** : HIGH
**Source** : Semgrep
`vuln-high`
**Emplacement** : scripts/sync_faiss_index.py:64
**Règle** : python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

### Extrait de code
```
requires login
```

### Lien CVE
https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#1

Vulnérabilité `scripts/sync_faiss_index.py:64_python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).