{"answers":{"affected":"4 open source packages ship an affected version, including @mikro-orm/knex and @mikro-orm/sql.","exploited":"There is no known exploitation of CVE-2026-44680 in the wild and no public exploit code.","fix":"Upgrade @mikro-orm/knex to 6.6.14 or later.","what":"CVE-2026-44680 is a high-severity SQL injection vulnerability in @mikro-orm knex, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-44680 and fix it if it is affected.\n\nWhat it is: CVE-2026-44680 is a high-severity SQL injection vulnerability in @mikro-orm knex, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-44680 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @mikro-orm/knex (npm): affected all versions; fixed in 6.6.14\n- @mikro-orm/knex (npm): affected all versions; fixed in 6.6.14\n- @mikro-orm/sql (npm): affected all versions; fixed in 7.0.14\n- @mikro-orm/sql (npm): affected all versions; fixed in 7.0.14\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-44680/ (Markdown: https://insights.sbomify.com/CVE-2026-44680/index.md)","id":"CVE-2026-44680","markdown":"https://insights.sbomify.com/CVE-2026-44680/index.md","name":"CVE-2026-44680","record":{"aliases":["GHSA-cfw5-68c4-ffqp"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js ORM library","requires_auth":"low_privilege","summary":"Attackers can inject arbitrary SQL via unescaped identifiers or JSON keys in MikroORM, potentially leading to data theft or modification.","user_interaction":"not_required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"description":"MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.","ecosystems":["npm"],"exploits":{"exploitdb":1,"first_seen":"2026-05-29","github_poc":1,"max_poc_stars":1,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-20T17:46:14Z","kind":"github_poc","ref":"https://github.com/CerberusMrXi/CVE-2026-44680-MikroORM-SQL-Injection-Exploit-Framework","stars":1,"title":"PoC tool for CVE-2026-44680 affecting MikroORM ≤7.0.13. Exploits JSON path injection to extract database contents via UNION-based attacks. Features vulnerability detection, automated data extraction, table enumeration, and blind injection support. Includes proxy integration for Burp Suite and WAF evasion techniques."},{"date":"2026-05-29","kind":"exploitdb","ref":"52600","stars":null,"title":"MikroORM   7.0.13 - SQL Injection"}],"tier":"poc_unverified"},"has_fix":true,"headline":"MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys","id":"CVE-2026-44680","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"sql_injection","year":"2026"},"n_packages":4,"n_references":5,"next":{"headline":"Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization","id":"CVE-2026-44681"},"packages":[{"ecosystem":"npm","fixed":["6.6.14"],"introduced":["0"],"last_affected":[],"package":"@mikro-orm/knex","purl":null,"source":"GHSA-cfw5-68c4-ffqp"},{"ecosystem":"npm","fixed":["6.6.14"],"introduced":["0"],"last_affected":[],"package":"@mikro-orm/knex","purl":"pkg:npm/%40mikro-orm/knex","source":"GHSA-cfw5-68c4-ffqp"},{"ecosystem":"npm","fixed":["7.0.14"],"introduced":["0"],"last_affected":[],"package":"@mikro-orm/sql","purl":null,"source":"GHSA-cfw5-68c4-ffqp"},{"ecosystem":"npm","fixed":["7.0.14"],"introduced":["0"],"last_affected":[],"package":"@mikro-orm/sql","purl":"pkg:npm/%40mikro-orm/sql","source":"GHSA-cfw5-68c4-ffqp"}],"prev":{"headline":"Tuist: Forgot password flow lacks throttling for reset email delivery","id":"CVE-2026-44679"},"products":["knex","mikro-orm","sql"],"published":"2026-05-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"GPL-2.0-or-later","name":"Exploit-DB"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-26","vendors":["@mikro-orm","mikro-orm"]},"summary":"Attackers can inject arbitrary SQL via unescaped identifiers or JSON keys in MikroORM, potentially leading to data theft or modification.","url":"https://insights.sbomify.com/CVE-2026-44680/"}