---
id: CVE-2020-11010
aliases:
  - GHSA-9j2c-x8qm-qmjq
  - PYSEC-2020-144
title: SQL injection in Tortoise ORM
summary: SQL injection in Tortoise ORM
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
vendor: tortoise-orm
product: tortoise-orm
ecosystem: pip
affected:
  - tortoise-orm < 0.15.23
  - 'tortoise-orm >= 0.16.0, < 0.16.6'
patched:
  - tortoise-orm 0.15.23
  - tortoise-orm 0.16.6
published: '2020-04-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:48:43.972863097Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9j2c-x8qm-qmjq'
references:
  - url: >-
      https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-11010'
  - url: >-
      https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/tortoise-orm/PYSEC-2020-144.yaml
  - url: 'https://github.com/tortoise/tortoise-orm'
tags:
  - osv
  - pip
epss: 0.01047
epssPercentile: 0.62659
ingestedAt: '2026-09-12T03:13:01.684Z'
---

## Overview

### Impact
Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.
SQLite & PostgreSQL was only affected when filtering with ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts)


### Patches
Please upgrade to 0.15.23+ or 0.16.6+

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Github](https://github.com/tortoise/tortoise-orm/issues)
* Chat to us on [Gitter](https://gitter.im/tortoise/community)

## Affected packages

- `tortoise-orm < 0.15.23`
- `tortoise-orm >= 0.16.0, < 0.16.6`

## Remediation

Upgrade to a patched release:

- `tortoise-orm 0.15.23`
- `tortoise-orm 0.16.6`