cybersec
Jun 12, 2026 · 6 min SQL InjectionCVE-2026-26198: When MIN() Forgot to Ask Whether the Column Was Real
Ormar's aggregate helpers turn a user-supplied string into raw SQL via `sqlalchemy.text()`. `sum()` and `avg()` accidentally got a guard rail; `min()` and `max()` drove straight off the cliff, letting an attacker smuggle a whole subquery in where a column name belongs.
— Trust nothing that reaches text()