CVE-2026-26198

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26198", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-11T19:56:24.813Z", "datePublished": "2026-02-24T02:03:47.094Z", "dateUpdated": "2026-02-24T20:35:44.673Z"}, "containers": {"cna": {"title": "ormar is vulnerable to SQL Injection through aggregate functions min() and max()", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/collerek/ormar/security/advisories/GHSA-xxh2-68g9-8jqr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/collerek/ormar/security/advisories/GHSA-xxh2-68g9-8jqr"}, {"name": "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16", "tags": ["x_refsource_MISC"], "url": "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16"}, {"name": "https://github.com/collerek/ormar/releases/tag/0.23.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/collerek/ormar/releases/tag/0.23.0"}], "affected": [{"vendor": "collerek", "product": "ormar", "versions": [{"version": ">= 0.9.9, < 0.23.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T02:03:47.094Z"}, "descriptions": [{"lang": "en", "value": "Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()` skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Version 0.23.0 contains a patch."}], "source": {"advisory": "GHSA-xxh2-68g9-8jqr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T20:29:06.990744Z", "id": "CVE-2026-26198", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T20:35:44.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26198", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-24T20:29:06.990744Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T20:29:22.532Z"}}], "cna": {"title": "ormar is vulnerable to SQL Injection through aggregate functions min() and max()", "source": {"advisory": "GHSA-xxh2-68g9-8jqr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "collerek", "product": "ormar", "versions": [{"status": "affected", "version": ">= 0.9.9, < 0.23.0"}]}], "references": [{"url": "https://github.com/collerek/ormar/security/advisories/GHSA-xxh2-68g9-8jqr", "name": "https://github.com/collerek/ormar/security/advisories/GHSA-xxh2-68g9-8jqr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16", "name": "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/collerek/ormar/releases/tag/0.23.0", "name": "https://github.com/collerek/ormar/releases/tag/0.23.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()` skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Version 0.23.0 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T02:03:47.094Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26198", "state": "PUBLISHED", "dateUpdated": "2026-02-24T20:35:44.673Z", "dateReserved": "2026-02-11T19:56:24.813Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T02:03:47.094Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ormar", "vendor": "collerek", "versions": [{"status": "affected", "version": ">= 0.9.9, < 0.23.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:collerek:ormar:*:*:*:*:*:python:*:*", "matchCriteriaId": "0CCC44C3-BA96-4145-BC7A-A312AC5E0621", "versionEndExcluding": "0.23.0", "versionStartIncluding": "0.9.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()` skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Version 0.23.0 contains a patch."}, {"lang": "es", "value": "Ormar es un mini ORM as\u00edncrono para Python. En las versiones 0.9.9 a 0.22.0, al realizar consultas agregadas, Ormar ORM construye expresiones SQL pasando los nombres de columna proporcionados por el usuario directamente a `sqlalchemy.text()` sin ninguna validaci\u00f3n o saneamiento. Los m\u00e9todos `min()` y `max()` en la clase `QuerySet` aceptan una entrada de cadena arbitraria como par\u00e1metro de columna. Mientras que `sum()` y `avg()` est\u00e1n parcialmente protegidos por una verificaci\u00f3n de tipo `is_numeric` que rechaza campos inexistentes, `min()` y `max()` omiten esta validaci\u00f3n por completo. Como resultado, una cadena controlada por el atacante se incrusta como SQL sin procesar dentro de la llamada a la funci\u00f3n agregada. Cualquier usuario no autorizado puede explotar esta vulnerabilidad para leer todo el contenido de la base de datos, incluidas las tablas no relacionadas con el modelo consultado, inyectando una subconsulta como par\u00e1metro de columna. La versi\u00f3n 0.23.0 contiene un parche."}], "id": "CVE-2026-26198", "lastModified": "2026-06-17T10:25:55.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26198", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T20:29:06.990744Z", "version": "2.0.3"}}]}, "published": "2026-02-24T03:16:01.100", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/collerek/ormar/releases/tag/0.23.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/collerek/ormar/security/advisories/GHSA-xxh2-68g9-8jqr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.9.9,0.23.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ormar", "source": "cna", "vendor": "collerek"}, "product": "ormar", "vendor": "collerek"}], "analysis": {"en": {"generated_at": "2026-04-17T15:55:26.089561+00:00", "value": {"mitigation_remediation": ["Upgrade the Ormar library to version 0.23.0 or later to apply the vendor patch that validates column names for aggregate functions.", "If an upgrade is not possible, audit all code that uses min() or max() in queries and ensure the column argument is validated against a whitelist of existing model fields before passing it to the ORM.", "When immediate remediation is needed, temporarily disable or remove calls to min() and max() in public-facing parts of the application until validation can be enforced.", "Monitor application logs for unusual aggregate queries or failed database operations that might indicate an attempt to exploit the vulnerability."], "summary": {"action": "Immediate Patch", "impact": "Unrestricted Data Access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Collerek Ormar library, versions 0.9.9 through 0.22.0. A fix was introduced in release 0.23.0. This includes all Python implementations that use Ormar for database interaction under the cited version range.", "description_and_impact": "Ormar is a lightweight asynchronous ORM for Python. In versions 0.9.9 through 0.22.0 aggregate queries reconstruct SQL by inserting the user\u2011supplied column name directly into the SQL expression via sqlalchemy.text() without validation. The min() and max() functions accept arbitrary strings as the column parameter and perform no type checking, unlike sum() or avg(). As a result, an attacker can inject a subquery or complex expression into the aggregate function, which is executed by the database engine. This flaw allows anyone who can submit a query to read arbitrary database tables, thereby compromising data confidentiality and integrity for the entire database.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity for unauthenticated or low\u2011privileged attackers. The EPSS score of less than 1% implies a low overall exploitation probability at present, but the fact that the code paths are exposed through application APIs means that exploitation could occur via normal user interaction. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no publicly known exploits have been documented yet. An attacker who can manipulate the column parameter\u2014e.g., via a public API endpoint\u2014can craft an input that introduces a subquery, retrieve all rows from unrelated tables, or exfiltrate sensitive data. The absence of input validation in min() and max() means the attack can succeed without additional credentials beyond whatever the application permits."}}}}, "created": "2026-02-24T09:53:28.131109+00:00", "updated": "2026-04-17T16:00:11.382340+00:00", "vendors": ["collerek", "collerek$PRODUCT$ormar"]}