Homepage

typeorm@1.1.0-nightly.20260716

Data-Mapper ORM for TypeScript and ES2023+. Supports MySQL/MariaDB, PostgreSQL, MS SQL Server, Oracle, SAP HANA, SQLite, MongoDB databases.

  • latest version

    1.1.0

  • latest non vulnerable version

    1.1.0

  • first published

    10 years ago

  • latest version published

    10 days ago

  • licenses detected

    • MIT
      >=0.0.2-alpha.68
  • View typeorm package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the typeorm package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Arbitrary Code Injection

    typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8).

    Affected versions of this package are vulnerable to Arbitrary Code Injection in the migration:generate. An attacker can execute arbitrary JavaScript code on the host system by injecting specially crafted schema metadata, such as column comments or default values containing ${...} expressions, which are then embedded unescaped into generated migration files and evaluated when the migration is loaded.

    How to fix Arbitrary Code Injection?

    Upgrade typeorm to version 0.3.31, 1.1.0 or higher.

    <0.3.31>=1.0.0 <1.1.0
    Go back to all versions of this package