A specially crafted object can be interpreted by MikroORM as a raw SQL fragment, creating a classic SQL injection flaw (CWE‑89). If an attacker can supply such an object to the ORM layer, they could execute arbitrary SQL against the connected database, causing data theft, modification, or deletion. The flaw exists prior to version 6.6.10 of the 6.x series and 7.0.6 of the 7.x series.

The vulnerability affects MikroORM versions earlier than 6.6.10 in the 6.x line and earlier than 7.0.6 in the 7.x line. Any Node.js application that imports the vulnerable library and uses its query construction methods is susceptible, regardless of the backend database.

The CVSS score of 9.3 signals a high‑severity flaw with ease of exploitation, yet the EPSS score is reported as less than 1%, suggesting that public exploitation is uncommon at the moment. The issue is not listed in CISA’s KEV catalog. While the precise attack vector is not detailed in the CVE, it can be reasonably inferred that an attacker would need to deliver the malicious object through application input that is later passed to MikroORM’s query methods. Further information on authentication requirements is not available from the CVE description.