Actions
SecOps #1170
open
CD
[Sécurité] Vulnérabilité de code : app/alerts/db.py:129 (python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)
SecOps #1170:
[Sécurité] Vulnérabilité de code : app/alerts/db.py:129 (python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)
Status:
Submitted
Priority:
Normal
Assignee:
-
Start date:
06/23/2026
Due date:
% Done:
0%
Estimated time:
spec_ref:
build_status:
build_number:
ci_run_url:
scan_status:
scan_report_url:
deploy_status:
preprod_url:
deployed_at:
branch:
pr_url:
security_key:
app/alerts/db.py:129_python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query
severity:
high
paused:
Description
**Sévérité** : HIGH
**Source** : Semgrep
`vuln-high`
**Emplacement** : app/alerts/db.py:129
**Règle** : python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
### Extrait de code
```
requires login
```
### Lien CVE
https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
Actions