Skip to content
OpenAdvisories

Package · npm

@mikro-orm/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.3
    CVE-2026-34220 Public exploit

    MikroORM is vulnerable to SQL Injection via specially crafted object

    MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This i…

    mikro-orm mikro-orm @mikro-orm/core npm
  • High 8.3
    CVE-2026-34221

    MikroORM has Prototype Pollution in Utils.merge

    MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object str…

    mikro-orm mikro-orm @mikro-orm/core npm