{
  "cveId": "CVE-2026-26198",
  "url": "https://patchblox.com/security/cve/CVE-2026-26198",
  "summary": "CVE-2026-26198 is fixed in ormar on 1 platform by DEBIAN-CVE-2026-26198 (version 0.23.0-1), released February 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ormar: Ormar is a async mini ORM for Python",
  "description": "Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into \u0060sqlalchemy.text()\u0060 without any validation or sanitization. The \u0060min()\u0060 and \u0060max()\u0060 methods in the \u0060QuerySet\u0060 class accept arbitrary string input as the column parameter. While \u0060sum()\u0060 and \u0060avg()\u0060 are partially protected by an \u0060is_numeric\u0060 type check that rejects non-existent fields, \u0060min()\u0060 and \u0060max()\u0060 skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Version 0.23.0 contains a patch.",
  "published": "2026-02-24T03:16:01Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.01013,
  "epssPercentile": 0.63452,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ormar",
      "release": "Debian 14",
      "fixedVersion": "0.23.0-1",
      "fix": "DEBIAN-CVE-2026-26198",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-26198",
      "released": "2026-02-24T03:16:01Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}