CVE-2026-84993

Name of the Vulnerable Software and Affected Versions MikroORM versions prior to 6.6.16 MikroORM versions prior to 7.1.7

Description The shared SQL layer validates the field key of an orderBy clause but fails to validate its direction value before the AbstractSqlPlatform.getOrderByExpression() function concatenates it into an ORDER BY clause. This allows applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() to permit a raw SQL fragment. This can lead to blind or boolean extraction of data accessible to the database account. This issue affects SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers.

Recommendations Update to version 6.6.16. Update to version 7.1.7.