Executive brief
MikroORM is a popular TypeScript ORM for Node.js that simplifies database interactions. Prior to patching, applications using MikroORM to handle user-supplied sort directions in database queries were vulnerable to SQL injection attacks, allowing attackers to execute arbitrary SQL commands and extract sensitive data from the database.
Technical details
The vulnerability exists in the AbstractSqlPlatform.getOrderByExpression() method and its overrides in BaseMySqlPlatform and MsSqlPlatform. While the orderBy field key is validated against entity metadata, the direction parameter was concatenated directly into the ORDER BY clause with only toLowerCase() applied, without validation against known QueryOrder values. An attacker can craft a request with a malicious direction value (e.g., through em.find(), em.findOne(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject()) to inject raw SQL fragments enabling blind or boolean-based data extraction. The fix validates the direction against an allow-list of legitimate values (asc, desc, nulls first, nulls last variants). Patches are available in versions 6.6.16 and 7.1.7. MongoDB driver is not affected.
Affected products
- MikroORM MikroORM before 6.6.16 and 7.1.7
Timeline
- 2026-09-16: disclosed
- 2026-07-17: patched: Fixed in versions 6.6.16 and 7.1.7