CVE-2026-44680
2 advisories.
npm/@mikro-orm/sql CVE-2026-44680: high 7.6, EPSS 1.29%
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
Action: Upgrade @mikro-orm/sql to 7.0.14 or later.
npm i @mikro-orm/sql@7.0.14Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.0.14 | - |
Fixed versions
| 7.0.14 |
Sources
- osv: GHSA-cfw5-68c4-ffqp
- https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
- https://nvd.nist.gov/vuln/detail/CVE-2026-44680
- https://github.com/mikro-orm/mikro-orm/pull/7653
- https://github.com/mikro-orm/mikro-orm/pull/7654
- https://github.com/mikro-orm/mikro-orm/pull/7656
- https://github.com/mikro-orm/mikro-orm/pull/7657
- https://github.com/mikro-orm/mikro-orm
CVE-2026-44680 · published · modified · JSON
npm/@mikro-orm/knex CVE-2026-44680: high 7.6, EPSS 1.29%
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
Action: Upgrade @mikro-orm/knex to 6.6.14 or later.
npm i @mikro-orm/knex@6.6.14Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.6.14 | - |
Fixed versions
| 6.6.14 |
Sources
- osv: GHSA-cfw5-68c4-ffqp#npm/@mikro-orm/knex
- https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
- https://nvd.nist.gov/vuln/detail/CVE-2026-44680
- https://github.com/mikro-orm/mikro-orm/pull/7653
- https://github.com/mikro-orm/mikro-orm/pull/7654
- https://github.com/mikro-orm/mikro-orm/pull/7656
- https://github.com/mikro-orm/mikro-orm/pull/7657
- https://github.com/mikro-orm/mikro-orm
CVE-2026-44680 · published · modified · JSON