Executive brief
MikroORM, a popular database tool for Node.js applications, contains a vulnerability that could allow an attacker to execute unauthorized database commands. By providing specially crafted text to certain application features—such as those involving multi-tenancy settings or complex data filters—an attacker can bypass security boundaries to read, modify, or delete sensitive data. This risk is particularly high for applications that pass user-provided input directly into database queries without strict validation.
Technical details
MikroORM's identifier-quoting helpers (Platform.quoteIdentifier) and JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) fail to properly escape dialect-specific delimiter characters (such as backticks, double quotes, or brackets). This vulnerability is reachable via multiple documented APIs, including multi-tenant schema options, JSON-property filters in em.find/qb.where, and various query builder keys (orderBy, groupBy, etc.) containing '.' or '::' sequences. An attacker with the ability to influence these strings can break out of the quoted SQL context to perform SQL injection. The issue affects all supported SQL dialects (PostgreSQL, MySQL, MSSQL, SQLite) but does not affect the MongoDB driver. Patches are available in versions 6.6.14 and 7.0.14.
Affected products
- MikroORM @mikro-orm/knex <= 6.6.13
- MikroORM @mikro-orm/sql <= 7.0.13
Timeline
- 2026-05-04: patched: Fixes merged into 6.x and master branches
- 2026-05-05: disclosed: Advisory published by maintainer
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-26: other: NVD publication date