Description
An SQL injection vulnerability exists in the @veramo/data-store package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is caused by insufficient validation of the column parameter in the order array of query requests.
Recommendation
Update the @veramo/data-store package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.0.2
- Patched version(s): 6.0.2
References
Could your website be exposed too?
SmartScanner can check your website for Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler - Vulnerability
- OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy paramet - CVE-2026-33142
- TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB) - Vulnerability
- TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update - CVE-2025-60542
You might also like:
See something that needs correcting? Let us knowUpdated January 16, 2026