SQL Injection in typeorm (GHSA-w7q7-vjp8-7jv4)

Description

Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.

Recommendation

Update the typeorm package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.15
• Patched version(s): 0.1.15

References

• GHSA-w7q7-vjp8-7jv4
• hackerone.com
• www.npmjs.com
• CWE-89
• OWASP 2021-A3

Related Issues

• TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update - CVE-2025-60542
• Payload does not invalidate JWTs after log out - CVE-2025-4643
• Parse Server has an OAuth login vulnerability - CVE-2025-30168
• Use of Insufficiently Random Values in undici - CVE-2025-22150

Tags:

npm

typeorm