ORM Injection.

An injection attack against applications using an Object-Relational Mapper that abuses dynamic queries, mass-assignment, or raw query escape hatches to manipulate data access. It belongs to the Attacks & Threats category of cybersecurity.

An injection attack against applications using an Object-Relational Mapper that abuses dynamic queries, mass-assignment, or raw query escape hatches to manipulate data access.

ORM injection occurs when developer-controlled, attacker-influenced input reaches an ORM (Hibernate, Entity Framework, SQLAlchemy, ActiveRecord, Sequelize, Prisma, Django ORM, etc.) through APIs that build queries dynamically. Vulnerable patterns include HQL/JPQL concatenation, ActiveRecord's where(string) with interpolation, Sequelize's Op.literal, SQLAlchemy text() with formatted strings, mass-assignment of unintended attributes, and unsafe sort/filter parameters from JSON APIs. Consequences range from classical SQL injection through to authorization bypass and privilege escalation when controls live in the ORM layer. Defenses: use parameterized query builders, strict allowlists for orderable/filterable fields, explicit attribute permitting (strong parameters), and avoid raw query escape hatches for untrusted input.

Defences for ORM Injection typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: HQL injection, JPQL injection.