typeorm@0.2.0-alpha.45 vulnerabilities

Data-Mapper ORM for TypeScript and ES2021+. Supports MySQL/MariaDB, PostgreSQL, MS SQL Server, Oracle, SAP HANA, SQLite, MongoDB databases.

latest version

0.3.27

latest non vulnerable version

0.4.0-alpha.1

first published

9 years ago

latest version published

1 months ago

licenses detected

MIT
>=0.0.2-alpha.68

View typeorm package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the typeorm package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M SQL Injection typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8). Affected versions of this package are vulnerable to SQL Injection via the `repository.save` or `repository.update` features when processing crafted input, due to improper handling in the `sqlstring` call with `stringifyObjects` set to false. An attacker can execute arbitrary SQL commands to bypass field-level update restrictions for columns such as user roles, by supplying specially crafted nested JSON. How to fix SQL Injection? Upgrade `typeorm` to version 0.3.26 or higher.	<0.3.26
H Prototype Pollution typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8). Affected versions of this package are vulnerable to Prototype Pollution. It allows an attacker that is able to save a specially crafted object to pollute the `Object` prototype and cause side effects on the library/application logic, such as Denial of Service attacks and/or SQL injections. How to fix Prototype Pollution? Upgrade `typeorm` to version 0.2.25 or higher.	<0.2.25

SQL Injection

typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8).

Affected versions of this package are vulnerable to SQL Injection via the repository.save or repository.update features when processing crafted input, due to improper handling in the sqlstring call with stringifyObjects set to false. An attacker can execute arbitrary SQL commands to bypass field-level update restrictions for columns such as user roles, by supplying specially crafted nested JSON.

How to fix SQL Injection?

Upgrade typeorm to version 0.3.26 or higher.

<0.3.26

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution. It allows an attacker that is able to save a specially crafted object to pollute the Object prototype and cause side effects on the library/application logic, such as Denial of Service attacks and/or SQL injections.

How to fix Prototype Pollution?

Upgrade typeorm to version 0.2.25 or higher.

<0.2.25

Go back to all versions of this package