CVE-2026-34220

Critical

Published: 31 March 2026

Published

31 March 2026

Modified

03 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 3.1th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34220 is a critical-severity SQL Injection (CWE-89) vulnerability in Mikro-Orm Mikroorm. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of flaws by upgrading to patched MikroORM versions 6.6.10 or 7.0.6, directly eliminating the SQL injection vulnerability.

SI-10 Information Input Validation good match

prevent

Validates syntax and semantics of untrusted inputs and specially crafted objects to prevent their interpretation as raw SQL query fragments by the ORM.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Monitors and scans for vulnerabilities like CVE-2026-34220 in software dependencies, enabling identification and patching before exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing Node.js ORM enables remote unauthenticated exploitation of web applications for initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query…

fragments. This issue has been patched in versions 6.6.10 and 7.0.6.

Deeper analysisAI

CVE-2026-34220 is a SQL injection vulnerability (CWE-89) affecting MikroORM, a TypeScript Object-Relational Mapping (ORM) library for Node.js that follows Data Mapper, Unit of Work, and Identity Map patterns. The flaw exists in versions prior to 6.6.10 and 7.0.6, where specially crafted objects can be interpreted as raw SQL query fragments, enabling arbitrary SQL execution. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By supplying malicious objects to applications using vulnerable MikroORM versions, attackers can inject and execute arbitrary SQL commands against the underlying database, potentially leading to data exfiltration, modification, or deletion, as well as full server compromise depending on database privileges and application context.

The GitHub Security Advisory (GHSA-gwhv-j974-6fxm) confirms the issue has been patched in MikroORM versions 6.6.10 and 7.0.6. Security practitioners should upgrade to these fixed versions immediately and review application code for any direct object manipulation that could pass untrusted input to MikroORM query builders.