CVE-2026-34221
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
MikroORM prior to versions 6.6.10 and 7.0.6 has a prototype pollution vulnerability in the Utils.merge helper used internally when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype.
Risk Assessment
An attacker can inject malicious properties into the object prototype, potentially leading to privilege escalation, code execution, or other attacks in applications using MikroORM.
Recommendation
Upgrade MikroORM to version 6.6.10 or 7.0.6 (or later). Verify that the application does not process untrusted input in merge operations.
Original NVD description (English source)
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype when merged. This issue has been patched in versions 6.6.10 and 7.0.6.