MikroORM contains a prototype pollution flaw in the helper function Utils.merge. The function fails to guard against special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to alter the JavaScript object prototype when merging. This weakness, classified as CWE‑1321, can enable an attacker to inject malicious properties or methods into prototypes, potentially leading to code execution or other unintended behavior.

The vulnerability affects users of the MikroORM project, specifically versions of mikro-orm before 6.6.10 and before 7.0.6. All Node.js applications that include these older MikroORM releases ingest the impacted code path for database or object handling.

The flaw carries a high CVSS score of 8.3, indicating significant impact and exploitability. While no EPSS data is available and the vulnerability is not listed in CISA's KEV catalog, the attack vector is likely remote through crafted requests that trigger the merge routine, such as API payloads or user-provided data. Given the lack of mitigation in older releases, a determined adversary could feasibly exploit the prototype pollution to achieve code execution or privilege escalation in the application.