ORM LEAKING MORE THAN YOU JOINED FOR

Summary from the TLDR InfoSec newsletter

ORM Leak vulnerabilities extend beyond susceptible ORMs such as Django and Prisma to any application that implements robust filtering capabilities. This article details practical examples, including Harbor CVE-2025-30086 (Beego ORM) and authentication bypasses via Prisma operator injection via type coercion, and discusses multiple techniques for bypassing naive protections, including exploiting Beego's broken expression parsing, where non-relational fields in filter expressions are overwritten by subsequent fields. Semgrep detection rules for Django, Prisma, Beego, and Entity Framework ORMs have been published to help identify these commonly overlooked vulnerabilities.