npm Package Vulnerabilities
Vulnerabilities associated with typeorm.
Packages
Clear package- openclaw588 vulnerabilities
- n8n139 vulnerabilities
- parse-server116 vulnerabilities
- flowise112 vulnerabilities
- electron65 vulnerabilities
- next64 vulnerabilities
- directus58 vulnerabilities
- nocodb54 vulnerabilities
- hono47 vulnerabilities
- axios43 vulnerabilities
- vm243 vulnerabilities
- ghost41 vulnerabilities
- @budibase/server40 vulnerabilities
- undici35 vulnerabilities
- flowise-components29 vulnerabilities
- @anthropic-ai/claude-code28 vulnerabilities
- dompurify28 vulnerabilities
- pnpm28 vulnerabilities
- astro25 vulnerabilities
- @openzeppelin/contracts-upgradeable22 vulnerabilities
- better-auth22 vulnerabilities
- vite22 vulnerabilities
- @openzeppelin/contracts21 vulnerabilities
- fuxa-server21 vulnerabilities
- nuxt21 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-73651MEDIUM | TypeORM: migration:generate template-literal code injectionTypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another i… CWE-94Aug 13, 2026 | CVSS5.7v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)### Impact Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users. `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this… CWE-89Jun 19, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.updateSQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. CWE-89Oct 29, 2025 | CVSS-v4.0 | EPSS0.247% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2022-33171CRITICAL | SQL injection in typeORMThe findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation CWE-89Jul 4, 2022 | CVSS9.8v3.1 | EPSS20.3% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8158CRITICAL | TypeORM vulnerable to MAID and Prototype PollutionPrototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks. | CVSS9.8v3.1 | EPSS2.12% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
SQL Injection in typeormVersions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation Upgrade to version 0.1.15 CWE-89Jun 6, 2019 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |