Skip to content
OpenAdvisories

Package · npm

typeorm

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 5.7
    CVE-2026-73651

    TypeORM: migration:generate template-literal code injection

    TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or…

    typeorm typeorm typeorm npm
  • Medium 5.9
    GHSA-9ggv-8w38-r7pm

    TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

    ### Impact Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users. `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` paramete…

    typeorm npm
  • Medium 6.5
    CVE-2025-60542

    TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

    SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

    typeorm npm
  • Critical 9.8
    CVE-2022-33171 Public exploit EPSS 21%

    SQL injection in typeORM

    The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection…

    typeorm npm
  • Critical 9.8
    CVE-2020-8158 Public exploit

    TypeORM vulnerable to MAID and Prototype Pollution

    Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

    typeorm npm
  • Critical 9.8
    GHSA-w7q7-vjp8-7jv4

    SQL Injection in typeorm

    Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation Upgrade to version 0.1.15

    typeorm npm