Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()` skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Version 0.23.0 contains a patch.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8d549898-3598-11f1-a8bc-3c7c3fba4204 advisory.

    https://github.com/ormar-orm/ormar/security/advisories reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries,
    Ormar ORM constructs SQL expressions by passing user-supplied column names directly into
    `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the
    `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are
    partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()`
    skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside
    the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire
    database contents, including tables unrelated to the queried model, by injecting a subquery as the column
    parameter. Version 0.23.0 contains a patch. (CVE-2026-26198)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries,     Ormar ORM constructs SQL expressions by passing user-supplied column names directly into     `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the     `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are     partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()`     skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside     the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire     database contents, including tables unrelated to the queried model, by injecting a subquery as the column     parameter. Version 0.23.0 contains a patch. (CVE-2026-26198)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
306040	FreeBSD : py-ormar -- vulnerabilities (8d549898-3598-11f1-a8bc-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	Local	critical
437936	SCA: security update for ormar (GHSA-xxh2-68g9-8jqr)	Tenable Cloud Security	SCA Checks	Local	high
437936	SCA: security update for ormar (GHSA-xxh2-68g9-8jqr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
299902	Linux Distros Unpatched Vulnerability : CVE-2026-26198	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-26198

high

Tenable Plugins

critical

high

high

high