Loading vulnerability…
CVE-2026-44680 affects MikroORM, a TypeScript ORM for Node.js. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper functions, including Platform.quoteIdentifier and the PostgreSQL/MSSQL-specific overrides, as well as JSON-path emitters such as Platform.getSearchJsonPropertyKey and quoteJsonKey, did not correctly escape characters that terminate the SQL identifier or string-literal contexts they generate. As a result, when application code passes attacker-influenced values into public ORM APIs that accept identifiers, schema names, filter keys, order keys, or JSON-property keys, an attacker can break out of the intended quoted context and inject arbitrary SQL into generated queries.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a small standalone Python exploit project with 4 files: LICENSE, README.md, requirements.txt, and a single executable script, exploit.py. The code is not tied to a major exploitation framework such as Metasploit or Nuclei. The main logic resides in exploit.py, which defines a MikroORMExploit class and a CLI entry point. Purpose: exploit CVE-2026-44680, a SQL injection issue in MikroORM JSON path handling. The exploit targets HTTP JSON API endpoints that accept attacker-controlled fields like filterField/filterValue and forwards them into vulnerable MikroORM query generation. Capabilities observed from code and documentation: (1) vulnerability detection using time-based SQLi with SLEEP(5) and error/UNION-style probes; (2) database metadata extraction via UNION SELECT of @@version, DATABASE(), USER(), @@hostname, @@port, etc.; (3) table enumeration via information_schema; (4) blind injection mode for inference-based extraction; (5) optional proxying through requests.Session proxies; and (6) local report generation to text files. Network behavior: the exploit sends HTTP POST requests with JSON bodies to a user-supplied base URL plus endpoint, defaulting to /api/users/search. It uses urljoin() to combine the base URL and endpoint. Headers include a browser-like User-Agent and Content-Type: application/json. No hardcoded external C2 or exfiltration infrastructure is present. Repository structure: README provides usage examples, affected versions, and sample commands; requirements.txt lists Python dependencies; exploit.py is the operational component. Based on the available code, this is an operational PoC rather than a detection-only script, because it includes active exploitation and data extraction logic, though payloads are relatively fixed rather than highly modular.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.