CVE-2026-34220
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
MikroORM, a TypeScript ORM for Node.js, has a SQL injection vulnerability in versions before 6.6.10 and 7.0.6. Specially crafted objects are interpreted as raw SQL query fragments.
Risk Assessment
Attackers can steal, modify, or delete database data, and in some cases gain system access.
Recommendation
Update MikroORM to version 6.6.10 or 7.0.6. Avoid passing untrusted data to ORM queries.
Other vulnerabilities in MikroORM
See all- CVE-2026-34221Critical
MikroORM prior to versions 6.6.10 and 7.0.6 has a prototype pollution vulnerability in the Utils.merge helper used internally when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype.
- CVE-2026-84993Medium
MikroORM before versions 6.6.16 and 7.1.7 does not validate the direction value of an orderBy clause before concatenating it into an ORDER BY statement. Applications that bind attacker-controlled data to the sort direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() may allow SQL fragment injection and blind data extraction.
- CVE-2026-44680High
In MikroORM before @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, the identifier-quoting functions and JSON-path emitters do not properly escape special characters. An application passing attacker-controlled data to public ORM APIs can lead to SQL injection.
Original NVD description (English source)
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched in versions 6.6.10 and 7.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS