CVE-2026-84993
MediumCVSS 6.5Summary
MikroORM before versions 6.6.16 and 7.1.7 does not validate the direction value of an orderBy clause before concatenating it into an ORDER BY statement. Applications that bind attacker-controlled data to the sort direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() may allow SQL fragment injection and blind data extraction.
Risk Assessment
An attacker can read data available to the database account through SQL injection, leading to information disclosure. The vulnerability affects multiple database drivers (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle), except MongoDB.
Recommendation
Update MikroORM to version 6.6.16 or 7.1.7 (or later), which contain the fix for this issue.
Other vulnerabilities in MikroORM
See all- CVE-2026-34221Critical
MikroORM prior to versions 6.6.10 and 7.0.6 has a prototype pollution vulnerability in the Utils.merge helper used internally when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype.
- CVE-2026-34220Critical
MikroORM, a TypeScript ORM for Node.js, has a SQL injection vulnerability in versions before 6.6.10 and 7.0.6. Specially crafted objects are interpreted as raw SQL query fragments.
- CVE-2026-44680High
In MikroORM before @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, the identifier-quoting functions and JSON-path emitters do not properly escape special characters. An application passing attacker-controlled data to public ORM APIs can lead to SQL injection.
Original NVD description (English source)
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenates it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths have the same behavior, affecting SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers, while MongoDB is not affected. This issue is fixed in versions 6.6.16 and 7.1.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS