MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS

• CVE-2026-44680: 1.45% estimated exploitation activity in the next 30 days; percentile 73.40 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. Affected APIs The vulnerability is reachable when application code passes an attacker-influenced string to any of the following documented APIs: Multi-tenant schema option — em.fork({ schema }), qb.withSchema(name), wrap(entity).setSchema(name), em.create(Cls, data, { schema }). The schema name is concatenated into the SQL identifier and never had its dialect quote character escaped. em.find / qb.where JSON-property filters — em.find(Entity, { jsonCol: { [userKey]: value } }). The user-supplied JSON…

Published by the source

8 May 2026, 19:17 UTC

Last modified by the source

10 Sep 2026, 03:50 UTC

Source last checked

26 Oct 2026, 12:53 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-cfw5-68c4-ffqp

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-cfw5-68c4-ffqp

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-44680

Advisory: MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
IDs: CVE-2026-44680, GHSA-cfw5-68c4-ffqp
Record: https://patchnext.com/advisories/cve-2026-44680 (revision 2, source checked 26 Oct 2026, 12:53 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: @mikro-orm/knex 6.6.14; @mikro-orm/sql 7.0.14. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @mikro-orm/knex: affected <= 6.6.13; fixed in 6.6.14
- npm @mikro-orm/sql: affected <= 7.0.13; fixed in 7.0.14

## Suggested inspection (read-only)
- `npm ls @mikro-orm/knex --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @mikro-orm/sql --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @mikro-orm/knex, @mikro-orm/sql.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-cfw5-68c4-ffqp (OSV record GHSA-cfw5-68c4-ffqp lists affected ranges: npm @mikro-orm/sql >=0 =0 <6.6.14 (fixed))
- Verified: https://github.com/advisories/GHSA-cfw5-68c4-ffqp (GitHub-reviewed advisory GHSA-cfw5-68c4-ffqp lists affected ranges: npm @mikro-orm/sql >=0 =0 <=6.6.13)

Commands are suggestions: review each one before running it.