Skip to content
OpenAdvisories

Package · npm

typeorm

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.7
    CVE-2026-73651

    TypeORM: migration:generate template-literal code injection

    TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or…

    typeorm typeorm typeorm npm
  • Medium 5.9
    GHSA-9ggv-8w38-r7pm

    TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

    ### Impact Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users. `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` paramete…

    typeorm npm
  • Medium 6.5
    CVE-2025-60542

    TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

    SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

    typeorm npm