A SQL injection vulnerability has been found in MikroORM, a popular Node.js ORM, affecting versions up to 7.0.13. Tracked as CVE-2026-44680, the flaw lets attackers break out of JSON path contexts and inject arbitrary SQL into database queries.
The vulnerability exists because MikroORM doesn’t properly escape runtime-controlled JSON path keys when building JSON_EXTRACT queries. When user input flows into the JSON filter structure through the em.find() API, a crafted key can escape the JSON context entirely and execute UNION SELECT statements against the database.
An attacker can extract arbitrary database information — version, running user, database name — by sending a malicious filter in a POST request. An advisory was published on GitHub under GHSA-cfw5-68c4-ffqp. The issue affects @mikro-orm/knex <= 6.6.13 and @mikro-orm/sql <= 7.0.13, tested on Debian Bookworm with Node.js 18 and MariaDB 10.x.
If your project uses MikroORM with user-controlled JSON filter keys, update immediately.
