CVE-2026-84993: MikroORM: SQL injection via unvalidated order direction in orderBy
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenates it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths have the same behavior, affecting SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers, while MongoDB is not affected. This issue is fixed in versions 6.6.16 and 7.1.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MikroORMto a version that resolves this vulnerability.Fixed in 6.6.16 - Upgrade
Upgrade
MikroORMto a version that resolves this vulnerability.Fixed in 7.1.7
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using MikroORM SQL drivers are affected: SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle. MongoDB is not affected.
What must an attacker control to exploit this issue?
An attacker needs to influence the order direction value passed to an affected ordering API, such as em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(). The vulnerable application must bind attacker-controlled request data to that direction value.
What is the potential impact?
Injected SQL fragments can be used for blind or boolean extraction of data accessible to the database account. The issue does not indicate integrity or availability impact.
What should be done if an immediate upgrade is not possible?
Do not pass request-controlled values directly as order directions. Restrict direction values to an application-defined allowlist before they reach MikroORM, such as the expected ascending or descending options.
How can teams determine whether they are exposed?
Review uses of the affected find and query-builder ordering APIs for order direction values derived from HTTP requests or other untrusted input. Versions before 6.6.16 and 7.1.7 require remediation for affected SQL-driver deployments.