These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
MikroORM, a TypeScript ORM for Node.js, contains an SQL injection vulnerability in versions prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14. The vulnerability resides in the identifier-quoting helper (Platform.quoteIdentifier and PostgreSQL/MSSQL overrides) and JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey), which fail to properly escape characters that delimit SQL identifi [truncated]
MikroORM, a TypeScript ORM for Node.js, has a prototype pollution vulnerability in versions before 6.6.10 and 7.0.6. This issue allows attacker-controlled input to modify the JavaScript object prototype when merged using the Utils.merge helper. The vulnerability exists due to the function's inability to prevent special keys such as __proto__, constructor, or prototype. The vulnerability can be exploited b [truncated]
A SQL injection vulnerability exists in MikroORM, a TypeScript ORM for Node.js, prior to versions 6.6.10 and 7.0.6. The vulnerability occurs when specially crafted objects are interpreted as raw SQL query fragments. This issue can lead to data breaches, data corruption, or other security issues if not properly mitigated. Users of affected versions should be aware of this vulnerability and take steps to mitigate it.