{"action":"Upgrade ormar to 0.23.1 or later.","affected":[{"fixed":"0.23.1","introduced":"0"}],"component":"ormar","cve_ids":["CVE-2026-27953"],"ecosystem":"PyPI","epss":0.01174,"exploited":false,"fixed_versions":["0.23.1"],"ghsa_id":"GHSA-f964-whrq-44h8","id":"tcs_01M5KGYAPHW2VPNPFR63XPSDBG","modified_at":"2026-07-13T07:15:39.669742060Z","published_at":"2026-03-19T21:17:09.573Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2247","https://github.com/ormar-orm/ormar/releases/tag/0.23.1","https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55","https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41","https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108","https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89","https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128","https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292","https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3","https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2247","url":"https://osv.dev/vulnerability/PYSEC-2026-2247"}],"summary":"ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validati"}