https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 19:57:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276734 EUVD-2026-276734 https://cve.radiocsirt.org/vuln/euvd-2026-276734 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27953 <p>ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting &#34;__pk_only__&#34;: true into a JSON request body. By injecting &#34;__pk_only__&#34;: true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar&#39;s canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.</p> <p>ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting &#34;__pk_only__&#34;: true into a JSON request body. By injecting &#34;__pk_only__&#34;: true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar&#39;s canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27953 https://cve.radiocsirt.org/vuln/ghsa-f964-whrq-44h8 <p><strong>Affected:</strong> PyPI: ormar</p> <p>### Summary</p> <p>A Pydantic validation bypass in `ormar`&#39;s model constructor allows any unauthenticated user to skip **all** field validation — type checks, constraints, `@field_validator`/`@model_validator` decorators, choices enforcement, and required-field checks — by injecting `&#34;__pk_only__&#34;: true` into a JSON request body. The unvalidated data is subsequently persisted to the database. This affects the **canonical usage pattern** recommended in ormar&#39;s official documentation and examples.</p> <p>A secondary `__excluded__` parameter injection uses the same design pattern to selectively nullify arbitrary model fields during construction.</p> <p>### Details</p> <p>**Root cause:** `NewBaseModel.__init__` ([`ormar/models/newbasemodel.py`, line 128](https://github.com/collerek/ormar/blob/master/ormar/models/newbasemodel.py#L128)) pops `__pk_only__` directly from user-supplied `**kwargs` before any validation occurs:</p> <p>```python # ormar/models/newbasemodel.py, lines 128-142 pk_only = kwargs.pop(&#34;__pk_only__&#34;, False) # ← extracted from user kwargs object.__setattr__(self, &#34;__pk_only__&#34;, pk_only)</p> <p>new_kwargs, through_tmp_dict = self._process_kwargs(kwargs)</p> <p>if not pk_only: # Normal path: full Pydantic validation new_kwargs = self.serialize_nested_models_json_fields(new_kwargs) self.__pydantic_validator__.validate_python( new_kwargs, self_instance=self ) else: # Bypass path: NO validation at all fields_set = {self.ormar_config.pkname} values = new_kwargs obj…</p> <p><strong>Affected:</strong> PyPI: ormar</p> <p>### Summary</p> <p>A Pydantic validation bypass in `ormar`&#39;s model constructor allows any unauthenticated user to skip **all** field validation — type checks, constraints, `@field_validator`/`@model_validator` decorators, choices enforcement, and required-field checks — by injecting `&#34;__pk_only__&#34;: true` into a JSON request body. The unvalidated data is subsequently persisted to the database. This affects the **canonical usage pattern** recommended in ormar&#39;s official documentation and examples.</p> <p>A secondary `__excluded__` parameter injection uses the same design pattern to selectively nullify arbitrary model fields during construction.</p> <p>### Details</p> <p>**Root cause:** `NewBaseModel.__init__` ([`ormar/models/newbasemodel.py`, line 128](https://github.com/collerek/ormar/blob/master/ormar/models/newbasemodel.py#L128)) pops `__pk_only__` directly from user-supplied `**kwargs` before any validation occurs:</p> <p>```python # ormar/models/newbasemodel.py, lines 128-142 pk_only = kwargs.pop(&#34;__pk_only__&#34;, False) # ← extracted from user kwargs object.__setattr__(self, &#34;__pk_only__&#34;, pk_only)</p> <p>new_kwargs, through_tmp_dict = self._process_kwargs(kwargs)</p> <p>if not pk_only: # Normal path: full Pydantic validation new_kwargs = self.serialize_nested_models_json_fields(new_kwargs) self.__pydantic_validator__.validate_python( new_kwargs, self_instance=self ) else: # Bypass path: NO validation at all fields_set = {self.ormar_config.pkname} values = new_kwargs obj…</p> https://cve.radiocsirt.org/vuln/ghsa-f964-whrq-44h8 https://cve.radiocsirt.org/vuln/pysec-2026-2247 <p><strong>Affected:</strong> PyPI: ormar</p> <p>ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting &#34;__pk_only__&#34;: true into a JSON request body. By injecting &#34;__pk_only__&#34;: true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar&#39;s canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.</p> <p><strong>Affected:</strong> PyPI: ormar</p> <p>ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting &#34;__pk_only__&#34;: true into a JSON request body. By injecting &#34;__pk_only__&#34;: true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar&#39;s canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2247 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27953 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: ormar, Ubuntu:25.10: ormar, Ubuntu:26.04:LTS: ormar</p> <p>ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting &#34;__pk_only__&#34;: true into a JSON request body. By injecting &#34;__pk_only__&#34;: true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar&#39;s canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: ormar, Ubuntu:25.10: ormar, Ubuntu:26.04:LTS: ormar</p> <p>ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting &#34;__pk_only__&#34;: true into a JSON request body. By injecting &#34;__pk_only__&#34;: true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar&#39;s canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27953