Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tortoise/tortoise-orm

              develop @ 9f42589
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

SQL Injection: 6 prior fixes. Scrutinize any change in this area.

tortoise/backends: most-fixed (3 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: The query builder and execution layer is highly susceptible to SQL injection when executing basic SELECT, count, exists, UPDATE, DELETE, and bulk queries if execution paths fall back to non-parameterized formats.

SQL Injection: Model lifecycle actions (like Model.save(), Model.delete(), and insertions) historically bypassed proper parameterized querying or statement preparation, exposing the core ORM persistence layer to query injection.

SQL Injection: Database-specific executors can fail to properly escape wildcards or special characters in contains, starts_with, and ends_with filter operations, leading to SQL injection in backend implementations.