Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not ${...}. An attacker who can write schema metadata (column comments, defaults, view definitions) achieves arbitrary code execution on the host that loads the generated migration. Details MigrationGenerateCommand.ts (L117-138) wraps each SQL statement in a JS template literal, escaping only backticks: Introspected schema strings reach this sink through driver query runners: | Driver | Metadata source | Source | |---|---|---| | Postgres | column DEFAULT, COMMENT, CHECK constraints, view definitions | PostgresQueryRunner.ts:1782, L1898, L2287, L4125 | | MySQL/MariaDB | COLUMNDEFAULT, COLUMNCOMMENT | MysqlQueryRunner.ts:2873-2974, L3580-3583 | | CockroachDB | Same patterns as Postgres | CockroachQueryRunner.ts | escapeComment() on each driver strips only null bytes, leaving ${...} intact: When the migration file is loaded (migration:run, import, or require), the JS…
Recommended action: Upgrade to 1.1.0 or 0.3.31 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Blind SQL injection vulnerability in UpdateQueryBuilder and SoftDeleteQueryBuilder affecting MySQL and MariaDB users. UpdateQueryBuilder and SoftDeleteQueryBuilder (including their addOrderBy variants) do not validate the order parameter against an allowlist of permitted values (ASC/DESC). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. SelectQueryBuilder.orderBy performs this validation correctly; the affected builders do not. If any code path passes user-controlled input to orderBy/addOrderBy on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction — even when the column name itself is hardcoded. Demonstrated impact includes: - Data exfiltration via time-based blind extraction (e.g. using SLEEP() to infer secret values bit by bit) - Row targeting manipulation in queries using LIMIT patterns - Denial of service via SLEEP()-based query exhaustion CVSS…
Recommended action: Upgrade to 0.3.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. Details Vulnerable Code: Intended Payload (non-malicious): username=myusername&city=Riga&name=Javad OR {username:\"myusername\",phone:12345,name:\"Javad\"} SQL query produced: Malicious Payload: username=myusername&city[name]=Riga&city[role]=admin OR {username:\"myusername\",city:{name:\"Javad\",role:\"admin\"}} SQL query produced with Injected Column: Above query is valid as city = name = Javad is a boolean expression resulting in city = 1 (false). “role” column is injected and updated. Underlying issue was due to TypeORM using mysql2 without specifying a value for the stringifyObjects option. In both mysql and mysql2 this option defaults to false. This option is then passed into SQLString library as false. This results in sqlstring parsing objects in a strange way using objectToValues.
Recommended action: Upgrade to 0.3.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.
Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
Recommended action: Upgrade to 0.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation Upgrade to version 0.1.15
Recommended action: Upgrade to 0.1.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.