Critical SQL Injection Vulnerability Found in ‘ormar’ Python Library

A critical SQL injection vulnerability (CVE-2026-26198, CVSS 9.8) was found in the ormar asynchronous Python ORM where user-supplied column names are passed directly into sqlalchemy.text() without sanitization; min() and max() can be abused to read entire databases across SQLite, PostgreSQL and MySQL. The flaw affects ormar versions 0.9.9 through 0.22.0, has broad impact given the library's widespread use in FastAPI and async applications, and was fixed in version 0.23.0 — administrators should audit and upgrade affected dependencies immediately.