6vulnerabilities
- Critical3 (50.0%)
- High1 (16.7%)
- Medium0 (0.0%)
- Moderate2 (33.3%)
- Low0 (0.0%)
typeorm
Ecosystem: npm
Downloads: 22.63 Mln
- 3CriticalAffects 3 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 2ModerateAffects 3 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (6)
Known vulnerabilities affecting typeorm, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-2rp8-mm9q-fp49 | Moderate | TypeORM: migration:generate template-literal code injection### Summary `typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backticks but not `${...}`. An attacker who can write schema metadata (column comments, defaults, view definitions) achieves arbitrary code execution on the host that loads the generated migration. ### Details `MigrationGenerateCommand.ts` (L117-138) wraps each SQL statement in a JS template literal, escaping only backticks: ```typescript " await queryRunner.query(`" + upQuery.query.replaceAll("`", "\\`") + "`" + ... ``` Introspected schema strings reach this sink |
| GitHub (opens in a new tab) | |
| GHSA-9ggv-8w38-r7pm | Moderate | TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)### Impact Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users. `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not. If any code path passes user-controlled input |
| GitHub (opens in a new tab) | |
| GHSA-q2pj-6v73-8rgj | High | TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update### Summary SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. ### Details Vulnerable Code: ```js const { username, city, name} = req.body; const updateData = { username, city, name, id:userId }; // Developer aims to only allow above three fields to be updated const result = await userRepo.save(updateData); ``` Intended Payload (non-malicious): ` username=myusername&city=Riga&name=Javad ` _OR_ `{username:\"myusername\",phone:12345,name: |
| GitHub (opens in a new tab) | |
| GHSA-fx4w-v43j-vc45 | Critical | SQL injection in typeORMThe findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation. |
| GitHub (opens in a new tab) | |
| GHSA-pf2j-9qmp-jqr2 | Critical | TypeORM vulnerable to MAID and Prototype PollutionPrototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks. |
| GitHub (opens in a new tab) | |
| GHSA-w7q7-vjp8-7jv4 | Critical | SQL Injection in typeormVersions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation Upgrade to version 0.1.15 |
| GitHub (opens in a new tab) |
- GHSA-2rp8-mm9q-fp49ModerateTypeORM: migration:generate template-literal code injection
< 0.3.31>= 1.0.0, < 1.1.0
### Summary `typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backticks but not `${...}`. An attacker who can write schema metadata (column comments, defaults, view definitions) achieves arbitrary code execution on the host that loads the generated migration. ### Details `MigrationGenerateCommand.ts` (L117-138) wraps each SQL statement in a JS template literal, escaping only backticks: ```typescript " await queryRunner.query(`" + upQuery.query.replaceAll("`", "\\`") + "`" + ... ``` Introspected schema strings reach this sink
CVE: CVE-2026-73651
- GHSA-9ggv-8w38-r7pmModerateTypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)
>= 0.1.12, < 0.3.29
### Impact Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users. `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not. If any code path passes user-controlled input
- GHSA-q2pj-6v73-8rgjHighTypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
< 0.3.26
### Summary SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. ### Details Vulnerable Code: ```js const { username, city, name} = req.body; const updateData = { username, city, name, id:userId }; // Developer aims to only allow above three fields to be updated const result = await userRepo.save(updateData); ``` Intended Payload (non-malicious): ` username=myusername&city=Riga&name=Javad ` _OR_ `{username:\"myusername\",phone:12345,name:
CVE: CVE-2025-60542
The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.
CVE: CVE-2022-33171
- GHSA-pf2j-9qmp-jqr2CriticalTypeORM vulnerable to MAID and Prototype Pollution
< 0.2.25
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
CVE: CVE-2020-8158
Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation Upgrade to version 0.1.15