CVE-2021-43822
SQL injection in jackalope/jackalope-doctrine-dbal
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property). Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
SQL injection in jackalope/jackalope-doctrine-dbal
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property). Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
- Record
CVE-2021-43822- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2021-2561
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property). Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
- Record
EUVD-2021-2561- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ph98-v78f-jqrm
SQL injection in jackalope/jackalope-doctrine-dbal
Impact
Users can provoke SQL injections if they can specify a node name or query.
Patches
Upgrade to version 1.7.4
If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property).
Workarounds
Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.
If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
References
No further references.
For more information
If you have any questions or comments about this advisory:
- Open an issue in jackalope/jackalope-doctrine-dbal repo
- Record
GHSA-ph98-v78f-jqrm- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property). Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
- Record
CVE-2021-43822- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property). Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
- Record
CVE-2021-43822- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-ph98-v78f-jqrm
SQL injection in jackalope/jackalope-doctrine-dbal
Impact
Users can provoke SQL injections if they can specify a node name or query.
Patches
Upgrade to version 1.7.4
If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property).
Workarounds
Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.
If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
References
No further references.
For more information
If you have any questions or comments about this advisory:
- Open an issue in jackalope/jackalope-doctrine-dbal repo
- Record
GHSA-ph98-v78f-jqrm- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jackalope/jackalope-doctrine-dbalPackagist |
before 1.7.4 | 1.7.4 |
jackalope/jackalope-doctrine-dbalPackagist |
before 1.7.4, plus listed versions 1.0.01.0.0-RC11.0.0-RC21.0.0-RC31.0.0-RC4 Show 39 moreShow less1.0.0-alpha11.0.0-beta11.0.0-beta21.0.0-beta31.0.0-beta41.1.01.1.0-RC11.1.11.1.21.1.31.1.41.1.51.2.01.2.0-RC11.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.3.01.3.11.3.21.3.31.3.41.3.51.3.61.4.01.4.11.5.01.5.11.6.01.6.11.7.01.7.11.7.21.7.3 |
1.7.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43822 is a high vulnerability (CVSS 8.5) in Jackalope Jackalope-doctrine-dbal, published December 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in jackalope/jackalope-doctrine-dbal 1.7.4.
References
github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-ph98-v78f-jqrm
nvd.nist.gov/vuln/detail/CVE-2021-43822