CVE-2019-15562

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-26 · updated 2026-06-17
Weakness: CWE-89

Description

GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm

Affected products

Gorm: before 1.9.10 — fixed in 1.9.10

How to fix

Upgrade to a fixed version: Gorm 1.9.10. Check the vendor advisory for mitigations.

References

https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427
https://github.com/go-gorm/gorm/pull/2519
https://github.com/go-gorm/gorm/pull/2674
https://github.com/jinzhu/gorm/releases/tag/v1.9.10
https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427
https://github.com/go-gorm/gorm/pull/2519
https://github.com/go-gorm/gorm/pull/2674
https://github.com/jinzhu/gorm/releases/tag/v1.9.10

Get alerted when CVE-2019-15562 or the next vulnerability affects your stack