npm/@mikro-orm/sql CVE-2026-44680: high 7.6, EPSS 1.45%

MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys

Action: Upgrade @mikro-orm/sql to 7.0.14 or later.

npm i @mikro-orm/sql@7.0.14

Affected

Fixed versions

Sources

• osv: GHSA-cfw5-68c4-ffqp
• https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
• https://nvd.nist.gov/vuln/detail/CVE-2026-44680
• https://github.com/mikro-orm/mikro-orm/pull/7653
• https://github.com/mikro-orm/mikro-orm/pull/7654
• https://github.com/mikro-orm/mikro-orm/pull/7656
• https://github.com/mikro-orm/mikro-orm/pull/7657
• https://github.com/mikro-orm/mikro-orm

CVE-2026-44680 · published 2026-05-08T19:17:45Z · modified 2026-09-10T03:50:46.602942797Z · JSON