SQL Injection

TypeORM is vulnerable to SQL Injection. The vulnerability is due to improper handling of object values in the sqlstring call where stringifyObjects defaults to false, which allows an attacker to inject crafted SQL through requests to repository.save or repository.update...

TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

Summary SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. Details Vulnerable Code: js const username, city, name = req.body; const updateData = username, city, name,...

GHSA-Q2PJ-6V73-8RGJ TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

Summary SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. Details Vulnerable Code: js const username, city, name = req.body; const updateData = username, city, name,...

EUVD-2025-36689

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false...

CVE-2025-60542

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false...

TypeORM 安全漏洞

TypeORM is an excellent Node.js ORM framework open-sourced by TypeORM. The goal of the software is to maintain support for the latest Javascript features; with the following features: 1 provide one-to-one, many-to-one, one-to-many, many-to-many relational processing of tables; 2 to help develop a...

CVE-2025-60542

The TypeORM library is vulnerable to SQL Injection (CWE-89) in versions prior to 0.3.26 . The root cause is the improper handling of object values within the sqlstring call, where the stringifyObjects parameter defaults to false . This allows an attacker to inject crafted SQL via requests to the ...