Mikro-orm vulnerabilities
We track 3 vulnerabilities in Mikro-orm products across 4 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 26, 2026.
Latest Mikro-orm vulnerabilities
- 7.6 High severity
mikro-orm: Improper Neutralization of Special Elements used in an SQL Command
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) a
- 9.1 Critical severity
mikro-orm: Improperly Controlled Modification of Object Prototype Attributes
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object stru
- 9.3 Critical severity
mikro-orm: Improper Neutralization of Special Elements used in an SQL Command
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This is