Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Pydantic validation bypass in ormar's model constructor allows any unauthenticated user to skip all field validation — type checks, constraints, @fieldvalidator/@modelvalidator decorators, choices enforcement, and required-field checks — by injecting "pkonly": true into a JSON request body. The unvalidated data is subsequently persisted to the database. This affects the canonical usage pattern recommended in ormar's official documentation and examples. A secondary excluded parameter injection uses the same design pattern to selectively nullify arbitrary model fields during construction. Details Root cause: NewBaseModel.init (ormar/models/newbasemodel.py, line 128) pops pkonly directly from user-supplied kwargs before any validation occurs: The pkonly flag was designed as an internal optimization for creating lightweight FK placeholder instances in ormar/fields/foreignkey.py (lines 41, 527). However, because it is extracted from kwargs via .pop() with a False default, any…
Recommended action: Upgrade to 0.23.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Report of SQL Injection Vulnerability in Ormar ORM A SQL Injection attack can be achieved by passing a crafted string to the min() or max() aggregate functions. Brief description When performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into sqlalchemy.text() without any validation or sanitization. The min() and max() methods in the QuerySet class accept arbitrary string input as the column parameter. While sum() and avg() are partially protected by an isnumeric type check that rejects non-existent fields, min() and max() skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Affected versions The vulnerable SelectAction.gettextclause() method and the…
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.