MikroORM is a TypeScript ORM for Node.js that allows specially crafted objects to be interpreted as raw SQL query fragments. This flaw permits attackers to inject arbitrary SQL commands, potentially leading to data compromise or unauthorized data modification, as the application may execute the injected fragments against the underlying database.

The vulnerability affects MikroORM versions earlier than 6.6.10 in the 6.x release line and earlier than 7.0.6 in the 7.x release line. Any deployment using these older releases is at risk.

With a CVSS base score of 9.3 the issue is critically severe. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide a crafted object that the ORM processes as a SQL fragment, which could occur through web interfaces or APIs that accept arbitrary input.