SQL injection in typeORM

Description

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection.

Recommendation

Update the typeorm package to the latest compatible version. Followings are version details:

Affected version(s): < 0.3.0
Patched version(s): 0.3.0

References

GHSA-fx4w-v43j-vc45
seclists.org
packetstormsecurity.com
CVE-2022-33171
CWE-89
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for SQL injection in typeORM and gives you actionable findings to investigate.

Start a free scan

Related Issues

Matrix-appservice-irc vulnerable to sql injection via roomIds argument - CVE-2022-3971
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update - CVE-2025-60542
Command Injection in ungit - CVE-2022-25766
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution - CVE-2026-54658

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated March 21, 2024