PyPI/ormar CVE-2026-27953: high 7.1, EPSS 1.21%
ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor
Action: Upgrade ormar to 0.23.1 or later.
pip install ormar==0.23.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.23.1 | - |
Fixed versions
| 0.23.1 |
Sources
- osv: GHSA-f964-whrq-44h8
- https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
- https://nvd.nist.gov/vuln/detail/CVE-2026-27953
- https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
- https://github.com/ormar-orm/ormar
- https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
- https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
- https://github.com/ormar-orm/ormar/releases/tag/0.23.1
CVE-2026-27953 · published · modified · JSON