CVE-2026-34220
SQL Injection in MikroORM Before 6.6.10 Allows Data Manipulation
Publication date: 2026-03-31
Last updated on: 2026-04-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mikro-orm | mikroorm | to 6.6.10 (exc) |
| mikro-orm | mikroorm | From 7.0.0 (inc) to 7.0.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reviewing your usage of MikroORM in your application, specifically looking for instances where untrusted user input is passed directly to MikroORM write APIs such as `wrap(entity).assign(userInput)` followed by `em.flush()`, `em.nativeUpdate()`, `em.nativeInsert()`, or `em.create()` followed by `em.flush()`.
Detection involves auditing your codebase for these patterns and checking the MikroORM version in use to ensure it is not older than 6.6.10 or 7.0.6.
There are no specific network or system commands provided to detect this vulnerability automatically.
Can you explain this vulnerability to me?
CVE-2026-34220 is a critical SQL injection vulnerability in MikroORM, a TypeScript ORM for Node.js. The flaw occurs when specially crafted objects controlled by an attacker are interpreted as raw SQL query fragments during query construction. This happens when untrusted user input is passed directly to MikroORM's write APIs without proper validation or schema enforcement.
The root cause is the use of duck-typed detection of internal ORM marker properties, which attackers can mimic to inject raw SQL. The vulnerability affects MikroORM versions up to 6.6.9 and 7.x up to 7.0.5 and has been fixed in versions 6.6.10 and 7.0.6 by replacing duck-typed checks with symbol-based markers that cannot be forged.
How can this vulnerability impact me? :
This vulnerability can allow attackers to inject arbitrary SQL commands into the database queries executed by MikroORM. Depending on the database and the specific queries, this can lead to unauthorized data access, data modification, or even complete compromise of the database.
If your application uses MikroORM versions prior to 6.6.10 or 7.0.6 and does not enforce strict input validation or schema checks, it is vulnerable to this attack. Exploiting this vulnerability could result in data breaches, data loss, or disruption of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a critical SQL injection flaw that allows attackers to inject arbitrary SQL commands if untrusted user input is passed without validation. This can lead to unauthorized access, modification, or disclosure of sensitive data stored in the database.
Such unauthorized data access or manipulation can result in non-compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding personal and sensitive information against breaches.
Therefore, if an application using MikroORM versions prior to the patched releases does not enforce strict input validation or schema checks, it may be at risk of violating these compliance requirements due to potential data breaches caused by this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade MikroORM to version 6.6.10 or 7.0.6 or later, where the vulnerability has been patched.
Additionally, enforce strict input validation and schema checks before passing any data to MikroORM write APIs to prevent untrusted input from being interpreted as raw SQL.