Skip to content
OpenAdvisories

Package · Ubuntu

ormar

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-26198 Public exploit

    ormar is vulnerable to SQL Injection through aggregate functions min() and max()

    Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The…

    collerek ormar ormar ormar Debian Ubuntu PyPI