{"action":"Upgrade ormar to 0.23.1 or later.","affected":[{"fixed":"0.23.1","introduced":"0"}],"component":"ormar","cve_ids":["CVE-2026-27953"],"ecosystem":"PyPI","epss":0.01211,"exploited":false,"fixed_versions":["0.23.1"],"ghsa_id":"GHSA-f964-whrq-44h8","id":"tcs_01M5KFEXZ3DTSC6NM198NRF63T","modified_at":"2026-07-13T07:26:39.416839876Z","published_at":"2026-03-19T16:27:43Z","references":["https://osv.dev/vulnerability/GHSA-f964-whrq-44h8","https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8","https://nvd.nist.gov/vuln/detail/CVE-2026-27953","https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3","https://github.com/ormar-orm/ormar","https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55","https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41","https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108","https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89","https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128","https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292","https://github.com/ormar-orm/ormar/releases/tag/0.23.1"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-f964-whrq-44h8","url":"https://osv.dev/vulnerability/GHSA-f964-whrq-44h8"}],"summary":"ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor"}