CVE-2026-44680 json
MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys
published 2026-05-08 6 mo ago modified 2026-09-10 1 mo ago also GHSA-cfw5-68c4-ffqp , EUVD-2026-31893
- cvss
- 7.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 73%
- public exploits
- 1
- Exploit-DB
Summary
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.
Patch / fix
- npm @mikro-orm/sql 7.0.14
- npm @mikro-orm/knex 6.6.14
- github.com/mikro-orm/mikro-orm#7653 pull request
- github.com/mikro-orm/mikro-orm#7654 pull request
- github.com/mikro-orm/mikro-orm#7656 pull request
- github.com/mikro-orm/mikro-orm#7657 pull request
Timeline
- Published
- First public exploit (EDB-52600)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
1.45% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-52600 MikroORM 7.0.13 - SQL Injection webapps, 2026-05-29
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
| GitHub | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @mikro-orm/sql | <7.0.14 |
7.0.14 |
| npm | @mikro-orm/knex | <6.6.14 |
6.6.14 |
Affected products
- mikro-orm mikro-orm
- @mikro-orm knex
- @mikro-orm sql
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/mikro-orm/mikro-orm/pull/7653
web
-
github.com
/mikro-orm/mikro-orm/pull/7654
web
-
github.com
/mikro-orm/mikro-orm/pull/7656
web
-
github.com
/mikro-orm/mikro-orm/pull/7657
web
-
github.com
/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-44680
advisory
-
github.com
/mikro-orm/mikro-orm
package
Sources
- CVE List CVE-2026-44680
- GitHub Advisory GHSA-cfw5-68c4-ffqp
- NVD CVE-2026-44680
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.