CVE-2026-34220

CriticalCVSS 9.8

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

MikroORM, a TypeScript ORM for Node.js, has a SQL injection vulnerability in versions before 6.6.10 and 7.0.6. Specially crafted objects are interpreted as raw SQL query fragments.

Risk Assessment

Attackers can steal, modify, or delete database data, and in some cases gain system access.

Recommendation

Update MikroORM to version 6.6.10 or 7.0.6. Avoid passing untrusted data to ORM queries.

Original NVD description (English source)

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched in versions 6.6.10 and 7.0.6.