Typeorm

typeorm

2 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Typeorm

typeorm

2 CVEs

CVEs (2)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-33171 1Typeorm 1Typeorm Jun 17, 2026 Jul 4, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead...Show more The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validationShow less
CVE-2020-8158 1Typeorm 1Typeorm Jun 17, 2026 Sep 18, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2022-33171

1Typeorm

Jun 17, 2026

Jul 4, 2022

N/A· v4

9.8 CRITICAL· v3

7.5 HIGH· v2

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validationShow less

CVE-2020-8158

1Typeorm

Jun 17, 2026

Sep 18, 2020

N/A· v4

9.8 CRITICAL· v3

7.5 HIGH· v2

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.