{"id":"CVE-2020-11010","aliases":["GHSA-9j2c-x8qm-qmjq","PYSEC-2020-144"],"title":"SQL injection in Tortoise ORM","summary":"SQL injection in Tortoise ORM","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","vendor":"tortoise-orm","product":"tortoise-orm","ecosystem":"pip","affected":["tortoise-orm < 0.15.23","tortoise-orm >= 0.16.0, < 0.16.6"],"patched":["tortoise-orm 0.15.23","tortoise-orm 0.16.6"],"published":"2020-04-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:48:43.972863097Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9j2c-x8qm-qmjq","references":[{"url":"https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11010"},{"url":"https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/tortoise-orm/PYSEC-2020-144.yaml"},{"url":"https://github.com/tortoise/tortoise-orm"}],"tags":["osv","pip"],"epss":0.01047,"epssPercentile":0.62204,"ingestedAt":"2026-09-12T03:13:01.684Z","slug":"CVE-2020-11010","body":"## Overview\n\n### Impact\nVarious forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.\nSQLite & PostgreSQL was only affected when filtering with ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts)\n\n\n### Patches\nPlease upgrade to 0.15.23+ or 0.16.6+\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Github](https://github.com/tortoise/tortoise-orm/issues)\n* Chat to us on [Gitter](https://gitter.im/tortoise/community)\n\n## Affected packages\n\n- `tortoise-orm < 0.15.23`\n- `tortoise-orm >= 0.16.0, < 0.16.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tortoise-orm 0.15.23`\n- `tortoise-orm 0.16.6`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}