CVE-2026-26198-analysis

CVE-2026-26198 — SQL Injection in Ormar ORM A deep dive into a critical CVSS 9.8 SQL injection vulnerability in a Python async ORM, with reproduction, analysis, and fix. The Vulnerability Ormar is a popular async mini ORM for Python, commonly used with FastAPI and Starlette. Versions 0.9.9 throug...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-26198 via ormar (>=0.10.16, <=0.20.2)

ormar PYPI version =0.10.16, =0.0.1, =0.3.1, =0.3.0, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-26198 Source advisory: OSV:PYSEC-2026-439...

FreeBSD : py-ormar -- vulnerabilities (8d549898-3598-11f1-a8bc-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8d549898-3598-11f1-a8bc-3c7c3fba4204 advisory. https://github.com/ormar-orm/ormar/security/advisories reports: Tenable has extracted the...

CVE-2026-27953

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

Linux Distros Unpatched Vulnerability : CVE-2026-27953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview ormar is an An async ORM with fastapi in mind and pydantic validation. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the model constructor when injecting the pkonly or excluded parameters when used...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: SNYK:PYTHON-ORMAR-15701843...

PYSEC-2026-2247

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: OSV:PYSEC-2026-2247...

DEBIAN-CVE-2026-27953

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

PYSEC-2026-2247

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

CVE-2026-27953

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

UBUNTU-CVE-2026-27953

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

CVE-2026-27953

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

CVE-2026-27953 ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: MEND:CVE-2026-27953...

CVE-2026-27953

Summary: CVE-2026-27953 affects ormar (Python)

CVE-2026-27953 ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

CVE-2026-27953 ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

CVE-2026-27953

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...