Loading story…
MikroORM, a TypeScript ORM for Node.js, disclosed and patched two high-severity vulnerabilities affecting releases before 6.6.10 and 7.0.6. The first, CVE-2026-34220, is a SQL injection flaw classified as CWE-89 in which specially crafted objects can be interpreted as raw SQL query fragments, creating a network-exploitable path with high confidentiality and integrity impact according to the published CVSS v4.0 assessment.
The second issue, CVE-2026-34221, is a prototype pollution vulnerability classified as CWE-1321 in MikroORM's internal Utils.merge helper. The function did not block dangerous keys such as __proto__, constructor, and prototype, allowing attacker-controlled input to alter the JavaScript object prototype. Both vulnerabilities were published through GitHub security advisories and fixed in MikroORM versions 6.6.10 and 7.0.6.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
GitHub security advisories received and published CVE-2026-34220 and CVE-2026-34221 for MikroORM on March 31, 2026. The disclosures classify the issues as CWE-89 SQL injection and CWE-1321 prototype pollution, respectively.
MikroORM fixed two vulnerabilities affecting versions prior to 6.6.10 and 7.0.6: a SQL injection issue caused by crafted objects being treated as raw SQL fragments, and a prototype pollution flaw in Utils.merge involving special keys such as __proto__, constructor, and prototype. The fixes were released in versions 6.6.10 and 7.0.6.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed six vulnerabilities, dubbed **Proto6**, in the widely used `protobuf.js` ecosystem that can enable **remote code execution**, **denial of service**, **prototype pollution**, and **prototype injection** in affected Node.js environments. The most severe flaw, `CVE-2026-44291`, allows arbitrary JavaScript execution through prototype pollution combined with unsafe code-generation behavior, while other issues involve recursion-based crashes, unsafe schema option path handling, crafted field-name abuse, and code injection in `pbjs` static output. The bugs affect applications and build pipelines that deserialize Protocol Buffers data or generate code from schemas using `protobuf.js`, including Google Cloud client libraries, gRPC-related tooling, messaging frameworks such as Baileys, and CI/CD workflows. Researchers said the library is deeply embedded across the JavaScript ecosystem, with more than 50 million weekly downloads and frequent transitive inclusion that can make exposure hard to identify. Fixed versions are available in `protobufjs` `7.5.6` and `8.0.2`, and in `protobufjs-cli` `1.2.1` and `2.0.2`; vulnerable releases include `protobuf.js` through `7.5.5` and `8.0.0`-`8.0.1`, and `protobufjs-cli` through `1.2.0` and `2.0.0`-`2.0.1`.
Jun 29, 2026
A critical software supply-chain vulnerability, **CVE-2026-23947** (CVSS **9.3**), was disclosed in *Orval*, a widely used npm tool that generates type-safe TypeScript/JavaScript clients from OpenAPI/Swagger specifications. The flaw allows **code injection** when Orval processes untrusted or compromised API specifications: attacker-controlled content in the `x-enumDescriptions` / `x-enum-descriptions` field is embedded without proper escaping in `getEnumImplementation()`, enabling malicious TypeScript/JavaScript to be written into generated client/schema files during `const enum` generation. Successful exploitation can lead to **arbitrary code execution in environments consuming the generated clients**, shifting risk to downstream developers and build/runtime pipelines that treat generated code as trusted. Affected versions are reported as **7.10.0 through 8.0.2**, and vendor guidance indicates updating to a fixed release (noted as *Orval* **8.0.2**) to remediate; the issue is described as similar to **CVE-2026-22785** but impacting a different `@orval/core` code path not covered by the earlier fix.
Jun 29, 2026
Two widely used JavaScript/TypeScript ecosystem tools disclosed high-severity vulnerabilities that can be triggered by untrusted input during code or document generation. *jsPDF* patched **CVE-2026-24737** (CVSS 8.1), where user-controlled properties in the `AcroForm` module can enable injection of arbitrary PDF objects (including **JavaScript actions**) via APIs such as `AcroformChoiceField.addOption` and `AcroFormCheckBox.appearanceState`, potentially leading to script execution when a victim opens a crafted PDF. It also patched **CVE-2026-24133** (CVSS 8.7), a denial-of-service condition in `BMPDecoder` reachable through `addImage`, where a malicious BMP with manipulated width/height headers can force excessive memory allocation and crash the application or browser tab. Separately, *Orval* fixed **CVE-2026-25141** (CVSS 9.3), a code-injection flaw in its OpenAPI-to-TypeScript client generation pipeline. The issue stems from insufficient sanitization of `x-enum-descriptions` content embedded into generated block comments; attackers can inject `*/` to terminate a comment and cause subsequent text to be treated as executable TypeScript/JavaScript. The advisory notes this is a bypass of an earlier fix for **CVE-2026-23947**, indicating prior mitigations were incomplete; organizations using Orval in CI/CD or consuming third-party OpenAPI specs are at heightened risk if inputs are not strictly trusted and validated.
Jun 29, 2026