Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@mikro-orm/knex

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6npmAmendedPublished

    MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys

    CVE-2026-44680 · GHSA-cfw5-68c4-ffqp

    Affected
    • npm @mikro-orm/knex <= 6.6.13
    Fixed in
    6.6.14· Vendor fix available
    Issue
    MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. Affected APIs The vulnerability is reachable when application code passes an attacker-influenced string to any of the following documented APIs: Multi-tenant schema option — em.fork({ schema }), qb.withSchema(name), wrap(entity).setSchema(name), em.create(Cls, data, { schema }). The schema name is concatenated into the SQL identifier and never had its dialect quote character escaped. em.find / qb.where JSON-property filters — em.find(Entity, { jsonCol: { [userKey]: value } }). The user-supplied JSON…

    Recommended action: Upgrade to 6.6.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →