MikroORM vulnerabilities
3 known CVE vulnerabilities in MikroORM, translated and rated.
- CVE-2026-34221Critical
MikroORM prior to versions 6.6.10 and 7.0.6 has a prototype pollution vulnerability in the Utils.merge helper used internally when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype.
- CVE-2026-34220Critical
MikroORM, a TypeScript ORM for Node.js, has a SQL injection vulnerability in versions before 6.6.10 and 7.0.6. Specially crafted objects are interpreted as raw SQL query fragments.
- CVE-2026-44680High
In MikroORM before @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, the identifier-quoting functions and JSON-path emitters do not properly escape special characters. An application passing attacker-controlled data to public ORM APIs can lead to SQL injection.