ormar ist anfällig für (SQL Injection) durch Aggregatfunktionen min() und max()

The SQL Injection vulnerability in Ormar ORM poses a significant risk. An attacker can craft malicious input that, when processed by the ORM, results in the execution of arbitrary SQL commands against the underlying database. This could lead to unauthorized access to sensitive data, including user credentials, financial information, or other confidential records. Depending on the database permissions, an attacker might even be able to modify or delete data, or gain control of the database server itself. The lack of input validation on column names within aggregate functions makes this exploitation relatively straightforward.

Applications utilizing Ormar ORM for database interaction are at risk. This includes Python web applications, backend services, and any system where user-supplied data is directly incorporated into SQL queries without proper sanitization. Projects relying on older, unpatched versions of Ormar ORM are particularly vulnerable.

• python / server:

import sqlalchemy
from ormar import Model, ORM, Field, Integer, String

# Example vulnerable query
class MyModel(Model):
    id = Field(Integer, primary_key=True)
    name = Field(String)

engine = sqlalchemy.create_engine('sqlite:///:memory:')
ormar_orm = ORM(engine)

# Vulnerable code - user input directly into min() function
user_input = "' UNION SELECT 1, 2, 3 --"
query = MyModel.select().order_by(MyModel.id.min(user_input))
result = normar_orm.db.execute(query)

# This query is vulnerable to SQL injection

• generic web: Inspect application logs for unusual SQL query patterns or errors related to aggregate functions. Look for queries containing unexpected characters or keywords that might indicate an injection attempt.

1. 2026-02-23Disclosure

   disclosure

1. Reserviert2026-02-11
2. Veröffentlicht2026-02-23
3. Geändert2026-02-24
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-26198 is to upgrade to Ormar ORM version 0.23.0 or later, which includes the necessary fixes. If an immediate upgrade is not feasible, consider implementing input validation and sanitization on all user-supplied data used in SQL queries. While not a complete solution, using parameterized queries or prepared statements can help prevent SQL Injection attacks. Carefully review and restrict database user permissions to limit the potential impact of a successful attack. After upgrading, verify the fix by attempting to inject SQL code into aggregate functions and confirming that the queries are properly sanitized.