CVE-2026-34220

EUVD-2026-17486
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched in versions 6.6.10 and 7.0.6.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
Affected Products (NVD)
VendorProductVersion
mikro-ormmikroorm
𝑥
< 6.6.10
mikro-ormmikroorm
7.0.0 ≤
𝑥
< 7.0.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-gwhv-j974-6fxm