PT-2026-39290 · Npm+1 · @Mikro-Orm/Knex+4

Martin Adámek

·

Published

2026-05-08

·

Updated

2026-05-26

·

CVE-2026-44680

CVSS v3.1

7.6

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions @mikro-orm/knex versions prior to 6.6.14 @mikro-orm/sql versions prior to 7.0.14
Description MikroORM's identifier-quoting helper (Platform.quoteIdentifier and postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) fail to properly escape characters that delimit the SQL identifier or string-literal context. This allows an attacker to break out of the quoted context and inject arbitrary SQL when application code passes attacker-influenced strings to public ORM APIs expecting an identifier or a JSON-property filter. This affects all supported SQL dialects, though the MongoDB driver is not affected.
Technical details include vulnerabilities in the following areas:
  • Multi-tenant schema option: used in em.fork({ schema }), qb.withSchema(name), wrap(entity).setSchema(name), and em.create(Cls, data, { schema }) where the schema variable is concatenated into the SQL identifier without escaping the dialect quote character.
  • JSON-property filters in em.find and qb.where: user-supplied JSON sub-keys in em.find(Entity, { jsonCol: { [userKey]: value } }) are spliced into the SQL string literal of the JSON path expression without escaping.
  • Keys in qb.where, qb.orderBy, qb.groupBy, qb.having, and qb.select: keys containing . or :: bypass the structured-where metadata validator in CriteriaNode and are processed by the flawed quoteIdentifier function.
Recommendations Upgrade @mikro-orm/knex to version 6.6.14 or later. Upgrade @mikro-orm/sql to version 7.0.14 or later. For multi-tenant applications using em.fork({ schema }), wrap().setSchema(), or qb.withSchema(), validate the schema name against a strict allowlist (e.g., ^[A-Za-z ][w$]*$) before passing it to the ORM. For applications passing where or orderBy filters from request input, validate every key against the entity's known properties and block keys containing . or :: from user input. For applications allowing filtering on JSON columns from request input, validate every JSON sub-key against an allowlist (e.g., ^[a-zA-Z ][w]*$) before passing it to em.find.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44680
GHSA-CFW5-68C4-FFQP

Affected Products

@Mikro-Orm/Knex
@Mikro-Orm/Sql
Knex
Mikroorm
Sql