CVE-2026-44680

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.

• CWE-89

• https://github.com/mikro-orm/mikro-orm/pull/7653
• https://github.com/mikro-orm/mikro-orm/pull/7654
• https://github.com/mikro-orm/mikro-orm/pull/7656
• https://github.com/mikro-orm/mikro-orm/pull/7657
• https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44671ZITADEL is an open source identity management platform. From…7.5
• CVE-2026-44672mapfish-print is a component of MapFish for printing templat…9.3
• CVE-2026-44673libyang is a YANG data modeling language library. Prior to S…7.5
• CVE-2026-44678Tuist is a virtual platform team for Swift app devs. In 1.18…7.1
• CVE-2026-44679Tuist is a virtual platform team for Swift app devs. Prior t…6.9
• CVE-2026-4468A vulnerability was determined in Comfast CF-AC100 2.6.0.8. …4.7
• CVE-2026-44681Authlib is a Python library which builds OAuth and OpenID Co…6.1
• CVE-2026-44682Local privilege escalation due to DLL hijacking vulnerabilit…7.3
• CVE-2026-44687In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stu…3.7
• CVE-2026-44688In Eclipse Theia versions prior to 1.71.0, the AI chat agent…8.8
• CVE-2026-4469A vulnerability was identified in itsourcecode Online Frozen…9.8
• CVE-2026-44690In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insu…7.5