How severe is CVE-2021-43822?

CVE-2021-43822 has a CVSS score of 7.5/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2021-43822?

CVE-2021-43822 affects the following packages: jackalope/jackalope-doctrine-dbal (Packagist). Ecosystems affected: Packagist.

How do I fix CVE-2021-43822?

Update jackalope/jackalope-doctrine-dbal to 1.7.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-43822 is resolved across your whole dependency graph.

How do I detect CVE-2021-43822 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for jackalope/jackalope-doctrine-dbal, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2021-43822 if there is no patch (or I can't update yet)?

Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Is CVE-2021-43822 actively exploited in the wild?

No public exploit code has been indexed for CVE-2021-43822 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2021-43822?

CVE-2021-43822 has an EPSS (Exploit Prediction Scoring System) score of 1.0%, placing it in the 62th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2021-43822?

CVE-2021-43822 is classified as SQL Injection (CWE-89). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2021-43822 published, and has it been updated?

CVE-2021-43822 was published on December 13, 2021 and was last updated on July 9, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘

🐘 Packagist

Not in CISA KEV

HIGH severity

CVE-2021-43822 — jackalope-doctrine-dbal

HIGHFix: jackalope/jackalope-doctrine-dbal@9d179a3

CVE-2021-43822 is a high-severity (CVSS 7.5) SQL Injection vulnerability in jackalope/jackalope-doctrine-dbal. A fix is available for jackalope/jackalope-doctrine-dbal — see the affected versions and patch details below.

SQL injection in jackalope/jackalope-doctrine-dbal

Also known asGHSA-ph98-v78f-jqrm

Published

Dec 13, 2021

Updated

Jul 9, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

1.0%probability of exploitation in next 30 days

Lower Risk+0.03%

Lower risk than most CVEs62th percentile — riskier than 62% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2021-43822 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected

🐘jackalope/jackalope-doctrine-dbal

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Users can provoke SQL injections if they can specify a node name or query.

Patches

Upgrade to version 1.7.4

If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property).

Workarounds

Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.

If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.

References

No further references.

For more information

If you have any questions or comments about this advisory:

Open an issue in jackalope/jackalope-doctrine-dbal repo

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`jackalope/jackalope-doctrine-dbal`	all versions	1.7.4`composer require jackalope/jackalope-doctrine-dbal:^1.7.4`

Affected Products

1 product · 1 configurations

Application

jackalope doctrine-dbaljackalope_doctrine-dbal_project

< 1.7.4

range

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for jackalope/jackalope-doctrine-dbal, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update jackalope/jackalope-doctrine-dbal to 1.7.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-43822 is resolved across your whole dependency graph.
Workarounds
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Frequently Asked Questions

### Impact Users can provoke SQL injections if they can specify a node name or query. ### Patches Upgrade to version 1.7.4 If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. ### Workarounds Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead