MikroORM SQL Injection Vulnerability

A SQL injection vulnerability exists in MikroORM, a TypeScript ORM for Node.js, in versions prior to 6.6.10 and 7.0.6. The issue arises when specially crafted objects are treated as raw SQL query fragments, allowing for the injection of SQL code. This vulnerability can be exploited if user-controlled input is directly passed to MikroORM's query construction APIs, potentially leading to SQL injection depending on the database and the executed query.

Impact

Exploitation allows for SQL injection, where an attacker can inject and execute malicious SQL fragments, potentially manipulating the database or accessing sensitive data.

Remediation

Users can upgrade to MikroORM versions 6.6.10 or 7.0.6 to address this vulnerability.