CVE-2020-11010

8.8 highEPSS 1.0%

High (8.8) in tortoise orm project tortoise orm. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in tortoise-orm 0.15.23, 0.16.6.

In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2020-04-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tortoise_orm_project:tortoise_orm

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9j2c-x8qm-qmjq	PyPI	tortoise-orm	<0.15.23	0.15.23
GHSA-9j2c-x8qm-qmjq	PyPI	tortoise-orm	>=0.16.0 <0.16.6	0.16.6
PYSEC-2020-144	PyPI	tortoise-orm	<0.15.23 >=0.16.0 <0.16.6	0.15.23, 0.16.6

References

Check your stack JSON