{"answers":{"affected":"2 open source packages ship an affected version, including typeorm.","exploited":"There is no known exploitation of GHSA-9ggv-8w38-r7pm in the wild and no public exploit code.","fix":"Upgrade typeorm to 0.3.29 or later.","what":"GHSA-9ggv-8w38-r7pm is a SQL injection vulnerability in typeorm, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-9ggv-8w38-r7pm and fix it if it is affected.\n\nWhat it is: GHSA-9ggv-8w38-r7pm is a SQL injection vulnerability in typeorm, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-9ggv-8w38-r7pm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- typeorm (npm): affected from 0.1.12; fixed in 0.3.29\n- typeorm (npm): affected from 0.1.12; fixed in 0.3.29\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-9ggv-8w38-r7pm/ (Markdown: https://insights.sbomify.com/GHSA-9ggv-8w38-r7pm/index.md)","id":"GHSA-9ggv-8w38-r7pm","markdown":"https://insights.sbomify.com/GHSA-9ggv-8w38-r7pm/index.md","name":"GHSA-9ggv-8w38-r7pm","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"TypeORM library","requires_auth":"none","summary":"Blind SQL injection in TypeORM allows attackers to exfiltrate data or cause denial of service via unvalidated sort directions in update queries.","user_interaction":"not_required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nBlind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users.\n\n`UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not.\n\nIf any code path passes user-controlled input to `orderBy`/`addOrderBy` on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction — even when the column name itself is hardcoded.\n\nDemonstrated impact includes:\n- **Data exfiltration** via time-based blind extraction (e.g. using `SLEEP()` to infer secret values bit by bit)\n- **Row targeting manipulation** in queries using `LIMIT` patterns\n- **Denial of service** via `SLEEP()`-based query exhaustion\n\nCVSS 3.1: **8.6 (High)** — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`\n\nAffected files (relative to commit `73fda419`):\n- `src/query-builder/UpdateQueryBuilder.ts`: lines 383–419 and 718–744\n- `src/query-builder/SoftDeleteQueryBuilder.ts`: lines 352–388 and 520–546\n\nThe vulnerability was introduced in commit `03799bd2` (v0.1.12) and is present through the latest release (v0.3.28).\n\n### Patches\n\nA fix has been released in 0.3.29 (1b66c44) and 1.0.0 (93eec63).\n\n### Workarounds\n\nApplications can manually validate the `order` argument before passing it to `orderBy` or `addOrderBy` on update or soft-delete query builders:\n\n```ts\nconst direction = userInput.toUpperCase();\nif (direction !== 'ASC' \u0026\u0026 direction !== 'DESC') {\n  throw new Error('Invalid sort direction');\n}\nqb.orderBy(column, direction as 'ASC' | 'DESC');\n```\n\nDo not pass user-controlled values to `orderBy`/`addOrderBy` on `UpdateQueryBuilder` or `SoftDeleteQueryBuilder` without this validation.\n\n### References\n\n- Introduced in commit 03799bd2 (v0.1.12)\n- Confirmed present in v0.3.28 (commit 73fda419)\n- See `SelectQueryBuilder.orderBy` for the correct validation pattern this fix should mirror","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)","id":"GHSA-9ggv-8w38-r7pm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"sql_injection","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["0.3.29"],"introduced":["0.1.12"],"last_affected":[],"package":"typeorm","purl":null,"source":"GHSA-9ggv-8w38-r7pm"},{"ecosystem":"npm","fixed":["0.3.29"],"introduced":["0.1.12"],"last_affected":[],"package":"typeorm","purl":"pkg:npm/typeorm","source":"GHSA-9ggv-8w38-r7pm"}],"products":null,"published":"2026-06-19","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Blind SQL injection in TypeORM allows attackers to exfiltrate data or cause denial of service via unvalidated sort directions in update queries.","url":"https://insights.sbomify.com/GHSA-9ggv-8w38-r7pm/"}