Data Manipulation Vulnerability in MikroORM by MikroORM
CVE-2026-84993
What is CVE-2026-84993?
MikroORM, a TypeScript ORM for Node.js, has a vulnerability related to the validation process of the orderBy clause. Specifically, the SQL layer does not properly validate the direction value of this clause before it is used in SQL statements. If applications bind user-controlled data to methods like em.find() or QueryBuilder.orderBy(), this can lead to the execution of raw SQL fragments. Such exploitation could allow attackers to extract sensitive data from the database. This issue affects various database drivers, including SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle, while MongoDB remains unaffected. The vulnerability has been resolved in MikroORM version 6.6.16 and later.
Affected Version(s)
mikro-orm < 6.6.16 < 6.6.16
mikro-orm >= 7.0.0, < 7.1.7 < 7.0.0, 7.1.7