CVE-2026-44680 MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys
Attackers can inject arbitrary SQL via unescaped identifiers or JSON keys in MikroORM, potentially leading to data theft or modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44680?
CVE-2026-44680 is a high-severity SQL injection vulnerability in @mikro-orm knex, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.
Weakness: CWE-89
Which versions are affected by CVE-2026-44680?
4 open source packages ship an affected version, including @mikro-orm/knex and @mikro-orm/sql.
| Package | Affected | Fixed in |
|---|---|---|
@mikro-orm/knex npm | All versions | 6.6.14 |
@mikro-orm/knex npm | All versions | 6.6.14 |
@mikro-orm/sql npm | All versions | 7.0.14 |
@mikro-orm/sql npm | All versions | 7.0.14 |
How do I fix CVE-2026-44680?
Upgrade @mikro-orm/knex to 6.6.14 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-44680 being exploited?
There is no known exploitation of CVE-2026-44680 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-cfw5-68c4-ffqp.