The vulnerability resides in MikroORM’s Utils.merge helper, which historically accepts objects without sanitizing special keys such as __proto__, constructor, or prototype. This omission permits an attacker to inject those keys into the merge process, thereby altering the JavaScript object prototype chain. The result can be unpredictable behavior, modification of prototype methods, and in some contexts escalation to arbitrary code execution. The weakness is identified as CWE‑1321, a prototype pollution flaw.

Vendors and products affected are the MikroORM TypeScript Object‑Relational Mapping library released by mikro‑orm under the product name "MikroORM". All versions preceding 6.6.10 of the 6.x series and 7.0.6 of the 7.x series are vulnerable; users of these releases should review their dependency graph for the presence of MikroORM.

The CVSS score of 8.3 reflects the high severity of prototype injection, particularly in environments where MikroORM processes untrusted input. EPSS indicates a low probability of exploitation (<1%), and the flaw is not listed in CISA’s KEV catalog, suggesting no widespread public exploits yet. However, the vulnerability can be leveraged remotely wherever an application exposes an API or interface that triggers Utils.merge with user‑controlled data. Successful exploitation would require an attacker to supply crafted input that merges into application objects, with potential cascading effects depending on how MikroORM interacts with the rest of the code.