VulnerableCode Package Details - pkg:npm/typeorm@0.1.14

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/typeorm@0.1.14

Essentials
History (4)

purl	pkg:npm/typeorm@0.1.14

Next non-vulnerable version	0.3.26
Latest non-vulnerable version	0.3.26
Risk	4.5

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-53hy-4nmr-mqgu Aliases: CVE-2020-8158 GHSA-pf2j-9qmp-jqr2	SQL Injection Prototype pollution vulnerability in the TypeORM package may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.	0.2.25 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ap94-g3tj-4yf3 Aliases: GHSA-w7q7-vjp8-7jv4 GMS-2019-144	SQL Injection in typeorm Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation Upgrade to version 0.1.15	0.1.15 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-dmg2-qbj8-yyhw Aliases: CVE-2022-33171 GHSA-fx4w-v43j-vc45	SQL injection in typeORM The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.	0.3.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-g39n-m58j-d7h7 Aliases: CVE-2025-60542 GHSA-q2pj-6v73-8rgj	TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.	0.3.26 Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T06:18:24.650623+00:00	GitLab Importer	Affected by	VCID-g39n-m58j-d7h7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2025-60542.yml	38.6.0
2026-06-06T02:40:08.676200+00:00	GitLab Importer	Affected by	VCID-dmg2-qbj8-yyhw	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2022-33171.yml	38.6.0
2026-06-04T20:39:05.611647+00:00	GitLab Importer	Affected by	VCID-53hy-4nmr-mqgu	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/CVE-2020-8158.yml	38.6.0
2026-06-04T20:22:32.632632+00:00	GitLab Importer	Affected by	VCID-ap94-g3tj-4yf3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/typeorm/GHSA-w7q7-vjp8-7jv4.yml	38.6.0