SQL Injection Vulnerability in MikroORM TypeScript ORM by Mikro
CVE-2026-34220

9.3CRITICAL

Key Information:

Vendor

Mikro-orm

Status
Mikro-orm
Vendor
CVE Published:
31 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-34220?

MikroORM, a TypeScript Object-Relational Mapper for Node.js, has a vulnerability that can lead to SQL injection. This issue arises when specially crafted objects are treated as raw SQL fragments, potentially allowing attackers to manipulate database queries. The vulnerability has been addressed in the latest releases, specifically versions 6.6.10 and 7.0.6, which provide essential patches to ensure the integrity of applications utilizing this ORM framework. Developers using earlier versions should update immediately to mitigate potential risks.

Affected Version(s)

mikro-orm < 6.6.10 < 6.6.10

mikro-orm >= 7.0.0-rc.0, < 7.0.6 < 7.0.0-rc.0, 7.0.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-34220
Created by EQSTLab

References

https://github.com/mikro-orm/mikro-orm/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.