CVE-2026-44680Disclosure

LOWCVSS 7.6 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-44680 MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, Mikr… https://www.cve.org/CVERecord?id=CVE-2026-44680 ----- Traducción: CVE-2026-44680 Mik… http://infoflow.cloud`
Post summary
A new CVE‑2026‑44680 is publicized for MikroORM, with earlier versions before 6.6.14 (knex) and 7.0.14 (sql) being vulnerable; updated releases contain the fix.
0000076
79 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-44680 MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, Mikr… https://www.cve.org/CVERecord?id=CVE-2026-44680
Post summary
The text references CVE-2026-44680 with version information, but does not supply technical details, a PoC, or a defined patch – it appears to be a basic disclosure of the vulnerability.
00000280
57.5K followersView on X

Explore more

Back to dashboard