PyPI/ormar CVE-2026-26198: critical 9.8, EPSS 0.78%

ormar is vulnerable to SQL Injection through aggregate functions min() and max()

Action: Upgrade ormar to 0.23.0 or later.

pip install ormar==0.23.0

Affected

Fixed versions

Sources

• osv: GHSA-xxh2-68g9-8jqr
• https://github.com/collerek/ormar/security/advisories/GHSA-xxh2-68g9-8jqr
• https://nvd.nist.gov/vuln/detail/CVE-2026-26198
• https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16
• https://github.com/collerek/ormar
• https://github.com/collerek/ormar/releases/tag/0.23.0

CVE-2026-26198 · published 2026-02-23T22:12:17Z · modified 2026-06-29T12:26:05.129774692Z · JSON