9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26198

CVE-2026-26198: ormar is vulnerable to SQL Injection through aggregate functions min() and max()

Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into sqlalchemy.text() without any validation or sanitization. The min() and max() methods in the QuerySet class accept arbitrary string input as the column parameter. While sum() and avg() are partially protected by an is_numeric type check that rejects non-existent fields, min() and max() skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Version 0.23.0 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26198

CVE-2026-26198:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ormar	pip	>= 0.9.9, <= 0.22.0	0.23.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in the ormar library, specifically within the min() and max() aggregate functions of the QuerySet class. The root cause is the lack of input validation for the column names passed to these functions. The user-provided column name, which can be a malicious SQL subquery, is passed down to the _query_aggr_function. This function, prior to the patch, did not validate the column name for min and max operations. The unvalidated input is then used in SelectAction.get_text_clause to construct a sqlalchemy.text object, which treats the input as literal SQL, leading to the injection. The patch, committed in a03bae14fe01358d3eaf7e319fcd5db2e4956b16, addresses this by adding a validation step in _query_aggr_function to ensure that the provided column name exists as a field on the model, effectively preventing arbitrary SQL from being executed.

Vulnerable functions

ormar.queryset.queryset.QuerySet._query_aggr_function

ormar/queryset/queryset.py

This function was vulnerable because it did not validate the input columns for 'min' and 'max' aggregation functions. It only performed a check for 'sum' and 'avg'. The patch adds a check to ensure the provided column name is a valid field in the model for all aggregate functions, thus preventing the SQL injection.

ormar.queryset.queryset.QuerySet.max

ormar/queryset/queryset.py

This function is an entry point for the vulnerability. It takes a user-controlled column name and passes it to the `_query_aggr_function` without proper sanitization, leading to SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.