Log in Start free

Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-44680MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys

High 7.6

In plain English

A high-severity SQL injection in knex from @mikro-orm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)1.5%top 26.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@mikro-orm/knex6.6.14GHSA-cfw5-68c4-ffqp
npm@mikro-orm/sql7.0.14GHSA-cfw5-68c4-ffqp

Affected products (as reported)

VendorProductVersions
mikro-orm mikro-orm >= 7.0.0-rc.0, < 7.0.14< 6.6.14
@mikro-orm knex < 6.6.14
@mikro-orm sql < 7.0.14

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References