Ormar is an asynchronous mini ORM for Python designed to simplify database interactions. Versions 0.9.9 through 0.22.0 contain a critical SQL injection vulnerability (CVE-2026-26198) due to improper neutralization of special elements in SQL commands (CWE-89). Specifically, the min() and max() methods in Ormar's QuerySet class accept arbitrary string inputs as column parameters without any validation or sanitization. These inputs are directly passed into sqlalchemy.text(), which constructs raw SQL expressions. Unlike sum() and avg() methods that perform partial numeric type checks, min() and max() skip validation entirely. This flaw enables an attacker to inject malicious SQL subqueries as the column parameter, allowing unauthorized reading of the entire database, including tables unrelated to the queried model. Exploitation requires no authentication or user interaction, making it trivially exploitable remotely. The vulnerability affects all Ormar versions from 0.9.9 up to but not including 0.23.0, where a patch was introduced to properly validate and sanitize inputs. Despite no known exploits in the wild at the time of disclosure, the high CVSS score (9.8) reflects the critical risk posed by this vulnerability.

The impact of CVE-2026-26198 is severe for organizations using affected Ormar versions in their Python applications. Exploitation allows attackers to perform unauthorized SQL injection attacks, leading to full disclosure of sensitive data across all database tables, including those outside the scope of the intended ORM model. This can result in exposure of personal identifiable information (PII), intellectual property, credentials, and other confidential data. The vulnerability compromises confidentiality, integrity, and availability since attackers can read, modify, or delete data. Because no authentication or user interaction is required, any exposed application endpoint using the vulnerable Ormar versions is at risk of remote exploitation. This can lead to data breaches, regulatory non-compliance, reputational damage, and potential lateral movement within compromised networks. The widespread use of Python and ORMs in web applications and microservices increases the scope and scale of potential impact globally.

To mitigate this vulnerability, organizations should immediately upgrade Ormar to version 0.23.0 or later, where the issue is patched. Until upgrade is possible, developers should avoid using the min() and max() aggregate methods with user-supplied input or implement strict input validation and sanitization to ensure only valid column names are accepted. Employing a whitelist of allowed column names or using ORM-safe query constructs can prevent injection. Additionally, applying Web Application Firewalls (WAFs) with SQL injection detection rules can provide a temporary layer of defense. Regular code audits and dependency scanning should be conducted to identify vulnerable Ormar versions. Monitoring application logs for suspicious query patterns and anomalous database access can help detect exploitation attempts. Finally, enforcing the principle of least privilege on database accounts used by applications limits the damage potential if exploitation occurs.