VulnerableCode Package Details - pkg:npm/typeorm@0.2.25

Search for packages

Vulnerability	Summary	Fixed by
VCID-dmg2-qbj8-yyhw Aliases: CVE-2022-33171 GHSA-fx4w-v43j-vc45	SQL injection in typeORM The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.	0.3.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-g39n-m58j-d7h7 Aliases: CVE-2025-60542 GHSA-q2pj-6v73-8rgj	TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.	0.3.26 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-dmg2-qbj8-yyhw
Aliases:
CVE-2022-33171
GHSA-fx4w-v43j-vc45

SQL injection in typeORM The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.

0.3.0
Affected by 1 other vulnerability.

VCID-g39n-m58j-d7h7
Aliases:
CVE-2025-60542
GHSA-q2pj-6v73-8rgj

TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

0.3.26
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-53hy-4nmr-mqgu	SQL Injection Prototype pollution vulnerability in the TypeORM package may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.	CVE-2020-8158 GHSA-pf2j-9qmp-jqr2

Vulnerability

Summary

Aliases

VCID-53hy-4nmr-mqgu

SQL Injection Prototype pollution vulnerability in the TypeORM package may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

CVE-2020-8158
GHSA-pf2j-9qmp-jqr2

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-07T20:45:29.748681+00:00	GHSA Importer	Fixing	VCID-53hy-4nmr-mqgu	https://github.com/advisories/GHSA-pf2j-9qmp-jqr2	38.6.0
2026-06-06T06:18:25.009957+00:00	GitLab Importer	Affected by	VCID-g39n-m58j-d7h7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2025-60542.yml	38.6.0
2026-06-06T02:40:09.012065+00:00	GitLab Importer	Affected by	VCID-dmg2-qbj8-yyhw	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2022-33171.yml	38.6.0
2026-06-04T17:35:15.529139+00:00	GithubOSV Importer	Fixing	VCID-53hy-4nmr-mqgu	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-pf2j-9qmp-jqr2/GHSA-pf2j-9qmp-jqr2.json	38.6.0
2026-06-04T16:20:26.289629+00:00	GitLab Importer	Fixing	VCID-53hy-4nmr-mqgu	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2020-8158.yml	38.6.0