CVE-2020-11010: Tortoise Orm Project Tortoise Orm

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).

Affected products

• Tortoise Orm Project Tortoise Orm: before 0.15.23 (fixed in 0.15.23); from 0.16.0, before 0.16.6 (fixed in 0.16.6)

Published 2020-04-20. Last modified 2026-06-17.