Search for packages
| purl | pkg:npm/typeorm@0.3.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-g39n-m58j-d7h7
Aliases: CVE-2025-60542 GHSA-q2pj-6v73-8rgj |
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-dmg2-qbj8-yyhw | SQL injection in typeORM The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation. |
CVE-2022-33171
GHSA-fx4w-v43j-vc45 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T06:18:26.072272+00:00 | GitLab Importer | Affected by | VCID-g39n-m58j-d7h7 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2025-60542.yml | 38.6.0 |
| 2026-06-05T21:32:24.813641+00:00 | GHSA Importer | Fixing | VCID-dmg2-qbj8-yyhw | https://github.com/advisories/GHSA-fx4w-v43j-vc45 | 38.6.0 |
| 2026-06-05T17:11:19.586911+00:00 | GitLab Importer | Fixing | VCID-dmg2-qbj8-yyhw | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2022-33171.yml | 38.6.0 |
| 2026-06-04T17:53:04.820291+00:00 | GithubOSV Importer | Fixing | VCID-dmg2-qbj8-yyhw | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-fx4w-v43j-vc45/GHSA-fx4w-v43j-vc45.json | 38.6.0 |