CVE-2026-34220
Published: 31 March 2026
Summary
CVE-2026-34220 is a critical-severity SQL Injection (CWE-89) vulnerability in Mikro-Orm Mikroorm. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-34220 is a SQL injection vulnerability (CWE-89) affecting MikroORM, a TypeScript Object-Relational Mapping (ORM) library for Node.js that follows Data Mapper, Unit of Work, and Identity Map patterns. The flaw exists in versions prior to 6.6.10 and 7.0.6, where specially crafted objects can be interpreted as raw SQL query fragments, enabling arbitrary SQL execution. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By supplying malicious objects to applications using vulnerable MikroORM versions, attackers can inject and execute arbitrary SQL commands against the underlying database, potentially leading to data exfiltration, modification, or deletion, as well as full server compromise depending on database privileges and application context.
The GitHub Security Advisory (GHSA-gwhv-j974-6fxm) confirms the issue has been patched in MikroORM versions 6.6.10 and 7.0.6. Security practitioners should upgrade to these fixed versions immediately and review application code for any direct object manipulation that could pass untrusted input to MikroORM query builders.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17486
Vulnerability details
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query…
more
fragments. This issue has been patched in versions 6.6.10 and 7.0.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing Node.js ORM enables remote unauthenticated exploitation of web applications for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of flaws by upgrading to patched MikroORM versions 6.6.10 or 7.0.6, directly eliminating the SQL injection vulnerability.
Validates syntax and semantics of untrusted inputs and specially crafted objects to prevent their interpretation as raw SQL query fragments by the ORM.
Monitors and scans for vulnerabilities like CVE-2026-34220 in software dependencies, enabling identification and patching before exploitation.