SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
{ "urgency": "not yet assigned" }