AIKIDO-2026-645757
@mikro-orm/sql is vulnerable to Incorrect Control Flow Implementation
30
Low Risk
This Affects:
@mikro-orm/sqlTL;DR
The SQL query builder compiles an empty $or array to no predicate at all instead of an always-false condition, so the intended restriction disappears from the generated SQL. Reads then return every row, and nativeDelete and nativeUpdate operate on the whole table, while $not and having variants emit invalid SQL. An application that builds an allow-list filter that can produce an empty $or fails open silently rather than matching nothing. The fix makes an empty $or compile to a false condition so the query matches no rows.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application builds query filters that can produce an empty $or array intended to match no rows.
Background info
@mikro-orm/sql is vulnerable to Incorrect Control Flow Implementation in versions 0.0.1 - 7.1.8.
How to fix this
Upgrade the @mikro-orm/sql library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant