CVE-2022-33171

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that...

TypeORM FindOne Authentication Bypass (CVE-2022-33171)

An authentication bypass vulnerability exists in TypeORM FindOne. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized access into the affected system...

CVE-2022-33171

creationtimestamp| type| source ---|---|--- 2022-07-04 20:12:37+00:00| seen| https://t.me/cibsecurity/45571 2025-12-08 15:00:08+00:00| published-proof-of-concept| Telegram/LcY7eBFwAwyzwe0KaufIGSBHQfjWzlBSbPNDVNgDN2U1XQ...

CVE-2022-33171

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that...

CVE-2022-33171

TypeORM prior to 0.3.0 is affected by an SQL injection vulnerability in findOne/findOneOrFail when user-controlled JSON is passed as FindOneOptions instead of an id string. The vulnerability arises because a crafted FindOneOptions object can be interpreted as part of the SQL query, allowing attac...

CVE-2022-33171

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that...