CVE-2026-84993: MikroORM SQL Injection Vulnerability

CVE-2026-84993 Overview

CVE-2026-84993 is a SQL injection vulnerability in MikroORM, a TypeScript object-relational mapper for Node.js. The flaw affects versions prior to 6.6.16 and 7.1.7. The shared SQL layer validates the field key of an orderBy clause but fails to validate its direction value before concatenating it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction argument in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() permit raw SQL fragments. The issue affects SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers. MongoDB is not affected.

Critical Impact

Authenticated attackers can perform blind or boolean-based SQL injection to extract data accessible to the database account, compromising confidentiality across supported SQL drivers.

Affected Products

• MikroORM versions prior to 6.6.16 (6.x branch)
• MikroORM versions prior to 7.1.7 (7.x branch)
• SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers

Discovery Timeline

• 2026-09-16 - CVE-2026-84993 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84993

Vulnerability Analysis

The vulnerability is a SQL Injection flaw classified under [CWE-89]. MikroORM's AbstractSqlPlatform.getOrderByExpression method concatenates the direction argument directly into the generated SQL. While the ORM validates that the column key belongs to a known field, no allowlist check applies to the direction string. An attacker who controls the direction value can inject arbitrary SQL that runs inside the ORDER BY clause. This context supports blind and boolean-based extraction techniques such as CASE WHEN expressions and subqueries. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths inherit the same unsafe behavior.

Root Cause

The root cause is missing input validation on the direction parameter in getOrderByExpression. The pre-patch code called direction.toLowerCase() and interpolated the result into the SQL string. No comparison was made against the accepted set of ordering keywords (asc, desc, asc nulls first, asc nulls last, desc nulls first, desc nulls last).

Attack Vector

Exploitation requires an application that passes untrusted request data, such as a query string parameter, into the orderBy direction of a MikroORM query. The attacker sends a crafted request containing a raw SQL fragment as the direction value. MikroORM emits that fragment into the ORDER BY clause, and the database evaluates it during query execution. The attacker uses response differences or timing to extract data one bit at a time.

// Security patch: packages/sql/src/AbstractSqlPlatform.ts (PR #7996)
export abstract class AbstractSqlPlatform extends Platform {
  static readonly #JSON_PROPERTY_NAME_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
  private static readonly ORDER_BY_DIRECTIONS = new Set([
    'asc',
    'desc',
    'asc nulls first',
    'asc nulls last',
    'desc nulls first',
    'desc nulls last',
  ]);

  protected readonly schemaHelper?: SchemaHelper;
}

// Security patch: packages/mssql/src/MsSqlPlatform.ts (PR #7996)
override getOrderByExpression(column: string, direction: QueryOrder, collation?: string): string[] {
  const dir = this.validateOrderByDirection(direction);
  const col = collation ? `${column} collate ${this.quoteCollation(collation)}` : column;

  switch (dir) {
    case QueryOrder.asc_nulls_first:
      return [`case when ${column} is null then 0 else 1 end, ${col} asc`];
    case QueryOrder.desc_nulls_last:
      return [`case when ${column} is null then 1 else 0 end, ${col} desc`];
    default:
      return [`${col} ${dir}`];
  }
}
// Source: https://github.com/mikro-orm/mikro-orm/commit/3aba926fd07156f5e1ebf06294fd77ee1215bad5

The patch introduces an allowlist of valid direction strings and adds a validateOrderByDirection helper that rejects any value outside the set.

Detection Methods for CVE-2026-84993

Indicators of Compromise

• Unexpected SQL keywords, parentheses, or comment sequences appearing in ORDER BY direction request parameters (for example ?order=asc,(CASE WHEN...)).
• Application logs showing MikroORM queries with ORDER BY clauses containing subqueries or CASE expressions not present in application source code.
• Database error responses referencing malformed ORDER BY syntax originating from user-facing endpoints.

Detection Strategies

• Perform a source code audit for calls to em.find(), em.findOne(), em.findAndCount(), and QueryBuilder.orderBy() where the direction argument derives from req.query, req.body, or req.params.
• Enable database query logging and search for ORDER BY clauses containing characters outside [a-z ].
• Deploy a web application firewall rule to flag ordering parameters containing SQL metacharacters such as (, --, ;, or SELECT.

Monitoring Recommendations

• Alert on repeated HTTP requests to the same endpoint that vary only in the ordering parameter, which indicates automated blind extraction.
• Baseline query execution times per endpoint and alert on outliers consistent with time-based SQL injection probes.
• Track MikroORM package versions in the software bill of materials to identify hosts still running versions below 6.6.16 or 7.1.7.

How to Mitigate CVE-2026-84993

Immediate Actions Required

• Upgrade MikroORM to version 6.6.16 on the 6.x branch or 7.1.7 on the 7.x branch.
• Audit all query construction sites that accept user input for the orderBy direction and enforce an application-side allowlist until the patched version is deployed.
• Review database account privileges used by MikroORM connections and apply least privilege to reduce data exposure if injection succeeds.

Patch Information

The fix is delivered in MikroORM Release v6.6.16 and MikroORM Release v7.1.7. See MikroORM Pull Request #7996 and MikroORM Pull Request #7997 for the code changes, and the MikroORM Security Advisory GHSA-7j79-7q93-6v69 for coordinated disclosure details.

Workarounds

• Validate the direction value against a strict allowlist (asc, desc, and the four nulls first/nulls last variants) before passing it to MikroORM.
• Map client-supplied sort tokens to enum values server-side rather than forwarding raw strings into the ORM.
• Restrict database account permissions so the connection MikroORM uses cannot read sensitive tables outside the application scope.

# Upgrade to the patched MikroORM release
npm install @mikro-orm/core@^7.1.7
# Or, for the 6.x branch
npm install @mikro-orm/core@^6.6.16

# Verify installed version
npm ls @mikro-orm/core