SQL Injection in typeorm

GHSA-w7q7-vjp8-7jv4

Published Jun 6, 2019 · Modified Feb 11, 2026

Description

Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.

Recommendation

Upgrade to version 0.1.15

References

WEB https://github.com/typeorm/typeorm/commit/d46c8b0e6c0db56bb5976a4917e9f67a43715111
WEB https://hackerone.com/reports/319458
PACKAGE https://github.com/typeorm/typeorm
WEB https://www.npmjs.com/advisories/800

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes