---
id: CVE-2026-84993
title: >-
  MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work
  and Identity Map patterns
summary: >-
  MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work
  and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer
  validates the field key of an orderBy clause but does not validate its
  direction value…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: mikro-orm
product: mikro-orm
affected:
  - mikro-orm < 6.6.16
  - 'mikro-orm >= 7.0.0, < 7.1.7'
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T18:17:17.620'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84993'
references:
  - url: >-
      https://github.com/mikro-orm/mikro-orm/commit/3aba926fd07156f5e1ebf06294fd77ee1215bad5
    label: security-advisories@github.com
  - url: >-
      https://github.com/mikro-orm/mikro-orm/commit/89e5546bf8e10f8465682016a3bdf622ff55d8c5
    label: security-advisories@github.com
  - url: 'https://github.com/mikro-orm/mikro-orm/pull/7996'
    label: security-advisories@github.com
  - url: 'https://github.com/mikro-orm/mikro-orm/pull/7997'
    label: security-advisories@github.com
  - url: 'https://github.com/mikro-orm/mikro-orm/releases/tag/v6.6.16'
    label: security-advisories@github.com
  - url: 'https://github.com/mikro-orm/mikro-orm/releases/tag/v7.1.7'
    label: security-advisories@github.com
  - url: >-
      https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-7j79-7q93-6v69
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T17:41:54.645625Z'
ingestedAt: '2026-09-16T16:59:56.555Z'
epss: 0.00485
epssPercentile: 0.40864
---

## Overview

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenates it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths have the same behavior, affecting SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers, while MongoDB is not affected. This issue is fixed in versions 6.6.16 and 7.1.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.