CVE-2026-84993

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenates it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths have the same behavior, affecting SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers, while MongoDB is not affected. This issue is fixed in versions 6.6.16 and 7.1.7.

• CWE-89

• https://github.com/mikro-orm/mikro-orm/commit/3aba926fd07156f5e1ebf06294fd77ee1215bad5
• https://github.com/mikro-orm/mikro-orm/commit/89e5546bf8e10f8465682016a3bdf622ff55d8c5
• https://github.com/mikro-orm/mikro-orm/pull/7996
• https://github.com/mikro-orm/mikro-orm/pull/7997
• https://github.com/mikro-orm/mikro-orm/releases/tag/v6.6.16
• https://github.com/mikro-orm/mikro-orm/releases/tag/v7.1.7
• https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-7j79-7q93-6v69

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84971Improper handling of an unexpected value size in the decrypt…6.5
• CVE-2026-84975PJSIP is a free and open source multimedia communication lib…7.4
• CVE-2026-84989ntopng is a web-based network traffic monitoring application…7.1
• CVE-2026-8499The Helpfulcrowd Product Reviews plugin for WordPress is vul…5.3
• CVE-2026-84990ntopng is a web-based network traffic monitoring application…8.8
• CVE-2026-84992md-editor-v3 is a Markdown editor for Vue 3 developed in JSX…6.1
• CVE-2026-84997react/http is an event-driven, streaming HTTP client and ser…7.5
• CVE-2026-8500Web::Passwd versions through 0.03 for Perl is vulnerable to …9.8
• CVE-2026-85006The HappyAddons for Elementor WordPress plugin before 3.50.…6.8
• CVE-2026-85008undici's cache interceptor documents that only safe HTTP met…5.3
• CVE-2026-85009The RestroPress WordPress plugin through 3.4.6 does not ver…6.5
• CVE-2026-8501Improper access control in the PCTCore64.sys Windows kernel …7.8