Homepage

typeorm@0.3.20-dev.8f371f2

Data-Mapper ORM for TypeScript and ES2023+. Supports MySQL/MariaDB, PostgreSQL, MS SQL Server, Oracle, SAP HANA, SQLite, MongoDB databases.

  • latest version

    1.0.0

  • latest non vulnerable version

    1.0.1-nightly.20260213

  • first published

    10 years ago

  • latest version published

    1 months ago

  • licenses detected

    • MIT
      >=0.0.2-alpha.68
  • View typeorm package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the typeorm package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    SQL Injection

    typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8).

    Affected versions of this package are vulnerable to SQL Injection in the orderBy or addOrderBy methods of update or soft-delete query builders when user-controlled input is not validated and is concatenated directly into SQL statements. An attacker can access sensitive data, manipulate targeted rows, or cause denial of service by injecting arbitrary SQL through the sort direction parameter.

    How to fix SQL Injection?

    Upgrade typeorm to version 0.3.29 or higher.

    >=0.1.12 <0.3.29
    • M
    SQL Injection

    typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8).

    Affected versions of this package are vulnerable to SQL Injection via the repository.save or repository.update features when processing crafted input, due to improper handling in the sqlstring call with stringifyObjects set to false. An attacker can execute arbitrary SQL commands to bypass field-level update restrictions for columns such as user roles, by supplying specially crafted nested JSON.

    How to fix SQL Injection?

    Upgrade typeorm to version 0.3.26 or higher.

    <0.3.26
    Go back to all versions of this package