What’s Vulnerable › Vulnerabilities

CVE-2020-11010: SQL injection in Tortoise ORM

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-20 · updated 2026-06-17
• Weakness: CWE-89

Description

In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).

Affected products

• tortoise-orm: before 0.15.23; from 0.16.0 before 0.16.6 — fixed in 0.15.23, 0.16.6

How to fix

Upgrade to a fixed version: tortoise-orm 0.15.23, 0.16.6. Check the vendor advisory for mitigations.

References

• https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3
• https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq
• https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3
• https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq

Get alerted when CVE-2020-11010 or the next vulnerability affects your stack