PyPI/ormar CVE-2026-27953: critical 9.8, EPSS 1.17%
ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validati
Action: Upgrade ormar to 0.23.1 or later.
pip install ormar==0.23.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.23.1 | - |
Fixed versions
| 0.23.1 |
Sources
- osv: PYSEC-2026-2247
- https://github.com/ormar-orm/ormar/releases/tag/0.23.1
- https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
- https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
- https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
- https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
- https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
CVE-2026-27953 · published · modified · JSON