Skip to content
OpenAdvisories

Package · Ubuntu

ormar

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.1
    CVE-2026-27953

    ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor

    ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "__pk_only__": true into a JSON request bod…

    ormar-orm ormar ormar ormar Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2026-26198 Public exploit

    ormar is vulnerable to SQL Injection through aggregate functions min() and max()

    Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The…

    collerek ormar ormar ormar Debian Ubuntu PyPI