SQL Injection in typeorm

GHSA-w7q7-vjp8-7jv4

Published Jun 6, 2019 · Modified Feb 11, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.

Recommendation

Upgrade to version 0.1.15

References

WEB https://github.com/typeorm/typeorm/commit/d46c8b0e6c0db56bb5976a4917e9f67a43715111
WEB https://hackerone.com/reports/319458
PACKAGE https://github.com/typeorm/typeorm
WEB https://www.npmjs.com/advisories/800

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes