ormar-orm vulnerabilities and threats

CVE-2026-27953 is a high-severity vulnerability in ormar, an async mini ORM for Python, affecting versions below 0.23.1. It allows unauthenticated attackers to bypass Pydantic model validation by injecting the "__pk_only__": true parameter in JSON request bodies, enabling direct persistence of unvalidated data to the database. A secondary injection parameter "__excluded__" can nullify arbitrary model fields, facilitating privilege escalation, data integrity violations, and business logic bypass. This vulnerability impacts applications using ormar. Model directly as a request body parameter, especially in FastAPI integrations following ormar's official documentation. The issue has been fixed in version 0.23.1.