MikroORM’s identifier quoting helper and JSON-path emitters failed to escape delimiters, allowing an attacker‑controlled string to break out of the quoted context and inject arbitrary SQL. The vulnerability is represented by CWE‑89 and affects applications that directly supply table or column names, or JSON path keys, from external input. If exploited, an attacker could execute arbitrary SQL statements, potentially compromising confidentiality, integrity, or availability of the database.

It affects the MikroORM library for Node.js, specifically the @mikro‑orm/knex adapter versions earlier than 6.6.14 and the @mikro‑orm/sql adapter versions earlier than 7.0.14. Any project using these adapters that passes untrusted data to ORM APIs that expect identifiers or JSON property filters is vulnerable. The issue also applies to the core mikro‑orm package used together with those adapters.

The CVSS score of 7.6 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, but because it permits arbitrary SQL injection, attackers with access to application input that is forwarded to the ORM can exploit it. The likely attack vector is from a web or API endpoint where user data is supplied to a query involving a table name or JSON key. Successful exploitation could lead to unauthorized database access or modification.