GHSA-9ggv-8w38-r7pm TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

Not scored Published 19 Jun 2026

Blind SQL injection in TypeORM allows attackers to exfiltrate data or cause denial of service via unvalidated sort directions in update queries.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-9ggv-8w38-r7pm?

GHSA-9ggv-8w38-r7pm is a SQL injection vulnerability in typeorm, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

Blind SQL injection vulnerability in UpdateQueryBuilder and SoftDeleteQueryBuilder affecting MySQL and MariaDB users.

UpdateQueryBuilder and SoftDeleteQueryBuilder (including their addOrderBy variants) do not validate the order parameter against an allowlist of permitted values (ASC/DESC). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. SelectQueryBuilder.orderBy performs this validation correctly; the affected builders do not.

If any code path passes user-controlled input to orderBy/addOrderBy on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction — even when the column name itself is hardcoded.

Demonstrated impact includes:

Data exfiltration via time-based blind extraction (e.g. using SLEEP() to infer secret values bit by bit)
Row targeting manipulation in queries using LIMIT patterns
Denial of service via SLEEP()-based query exhaustion

CVSS 3.1: 8.6 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected files (relative to commit 73fda419):

src/query-builder/UpdateQueryBuilder.ts: lines 383–419 and 718–744
src/query-builder/SoftDeleteQueryBuilder.ts: lines 352–388 and 520–546

The vulnerability was introduced in commit 03799bd2 (v0.1.12) and is present through the latest release (v0.3.28).

Patches

A fix has been released in 0.3.29 (1b66c44) and 1.0.0 (93eec63).

Workarounds

Applications can manually validate the order argument before passing it to orderBy or addOrderBy on update or soft-delete query builders:

const direction = userInput.toUpperCase();
if (direction !== &#39;ASC&#39; &amp;&amp; direction !== &#39;DESC&#39;) {
  throw new Error(&#39;Invalid sort direction&#39;);
}
qb.orderBy(column, direction as &#39;ASC&#39; | &#39;DESC&#39;);

Do not pass user-controlled values to orderBy/addOrderBy on UpdateQueryBuilder or SoftDeleteQueryBuilder without this validation.

References

Introduced in commit 03799bd2 (v0.1.12)
Confirmed present in v0.3.28 (commit 73fda419)
See SelectQueryBuilder.orderBy for the correct validation pattern this fix should mirror

Which versions are affected by GHSA-9ggv-8w38-r7pm?

2 open source packages ship an affected version, including typeorm.

Package	Affected	Fixed in
`typeorm` npm	From `0.1.12`	`0.3.29`
`typeorm` npm	From `0.1.12`	`0.3.29`

How do I fix GHSA-9ggv-8w38-r7pm?

Upgrade typeorm to 0.3.29 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is GHSA-9ggv-8w38-r7pm being exploited?

There is no known exploitation of GHSA-9ggv-8w38-r7pm in the wild and no public exploit code.