MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mikro-orm | mikro-orm | 7.0.0-rc.0 to before 7.0.14; before 6.6.14 | 7.0.14, 6.6.14 | Patch available | CNA |
| mikro-orm | knex | before 6.6.14 | 6.6.14 | Patch available | CNA |
| mikro-orm | sql | before 7.0.14 | 7.0.14 | Patch available | CNA |
| — | @mikro-orm/sql (npm) | before 7.0.14 | 7.0.14 | Patch available | GHSA-cfw5-68c4-ffqp |
| — | @mikro-orm/knex (npm) | before 6.6.14 | 6.6.14 | Patch available | GHSA-cfw5-68c4-ffqp |
- mikro-orm Vendormikro-orm Affected 7.0.0-rc.0 to before 7.0.14; before 6.6.14 Fixed in 7.0.14, 6.6.14 Patch available CNA
- knex Vendormikro-orm Affected before 6.6.14 Fixed in 6.6.14 Patch available CNA
- sql Vendormikro-orm Affected before 7.0.14 Fixed in 7.0.14 Patch available CNA
- @mikro-orm/sql (npm) Vendor— Affected before 7.0.14 Fixed in 7.0.14 Patch available GHSA-cfw5-68c4-ffqp
- @mikro-orm/knex (npm) Vendor— Affected before 6.6.14 Fixed in 6.6.14 Patch available GHSA-cfw5-68c4-ffqp
Remediation
- Fix · CNA mikro-orm (mikro-orm) Fixed in 7.0.14, 6.6.14
- Fix · CNA knex (@mikro-orm) Fixed in 6.6.14
- Fix · CNA sql (@mikro-orm) Fixed in 7.0.14
- Fix · GHSA-cfw5-68c4-ffqp @mikro-orm/sql (npm) Fixed in 7.0.14 Advisory →
- Fix · GHSA-cfw5-68c4-ffqp @mikro-orm/knex (npm) Fixed in 6.6.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44680
- 2026-10-03 Alias added: GHSA-cfw5-68c4-ffqp
References
Other 6
- https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
- https://github.com/mikro-orm/mikro-orm/pull/7653
- https://github.com/mikro-orm/mikro-orm/pull/7654
- https://github.com/mikro-orm/mikro-orm/pull/7656
- https://github.com/mikro-orm/mikro-orm/pull/7657
- https://github.com/mikro-orm/mikro-orm
More mikro-orm vulnerabilities
- TI-2026-26515 MikroORM is vulnerable to SQL Injection via specially crafted object CVSS 4.0CRITICAL 9.3
- TI-2026-26516 MikroORM has Prototype Pollution in Utils.merge CVSS 4.0HIGH 8.3
- TI-2026-58399 MikroORM: SQL injection via unvalidated order direction in orderBy CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-44680 · CVE Program
- CVE-2026-44680 · NVD
- FIRST EPSS
- GHSA-cfw5-68c4-ffqp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences