# GHSA-9ggv-8w38-r7pm: TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

> Blind SQL injection in TypeORM allows attackers to exfiltrate data or cause denial of service via unvalidated sort directions in update queries.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 19 Jun 2026

## What is GHSA-9ggv-8w38-r7pm?

GHSA-9ggv-8w38-r7pm is a SQL injection vulnerability in typeorm, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Impact

Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users.

`UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not.

If any code path passes user-controlled input to `orderBy`/`addOrderBy` on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction — even when the column name itself is hardcoded.

Demonstrated impact includes:
- **Data exfiltration** via time-based blind extraction (e.g. using `SLEEP()` to infer secret values bit by bit)
- **Row targeting manipulation** in queries using `LIMIT` patterns
- **Denial of service** via `SLEEP()`-based query exhaustion

CVSS 3.1: **8.6 (High)** — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`

Affected files (relative to commit `73fda419`):
- `src/query-builder/UpdateQueryBuilder.ts`: lines 383–419 and 718–744
- `src/query-builder/SoftDeleteQueryBuilder.ts`: lines 352–388 and 520–546

The vulnerability was introduced in commit `03799bd2` (v0.1.12) and is present through the latest release (v0.3.28).

### Patches

A fix has been released in 0.3.29 (1b66c44) and 1.0.0 (93eec63).

### Workarounds

Applications can manually validate the `order` argument before passing it to `orderBy` or `addOrderBy` on update or soft-delete query builders:

```ts
const direction = userInput.toUpperCase();
if (direction !== 'ASC' && direction !== 'DESC') {
  throw new Error('Invalid sort direction');
}
qb.orderBy(column, direction as 'ASC' | 'DESC');
```

Do not pass user-controlled values to `orderBy`/`addOrderBy` on `UpdateQueryBuilder` or `SoftDeleteQueryBuilder` without this validation.

### References

- Introduced in commit 03799bd2 (v0.1.12)
- Confirmed present in v0.3.28 (commit 73fda419)
- See `SelectQueryBuilder.orderBy` for the correct validation pattern this fix should mirror

## Which versions are affected by GHSA-9ggv-8w38-r7pm?

2 open source packages ship an affected version, including typeorm.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `typeorm` | npm | From 0.1.12 | 0.3.29 |
| `typeorm` | npm | From 0.1.12 | 0.3.29 |

## How do I fix GHSA-9ggv-8w38-r7pm?

Upgrade typeorm to 0.3.29 or later.

## Is GHSA-9ggv-8w38-r7pm being exploited?

There is no known exploitation of GHSA-9ggv-8w38-r7pm in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-9ggv-8w38-r7pm and fix it if it is affected.

What it is: GHSA-9ggv-8w38-r7pm is a SQL injection vulnerability in typeorm, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-9ggv-8w38-r7pm in the wild and no public exploit code.

Affected packages and fixed versions:
- typeorm (npm): affected from 0.1.12; fixed in 0.3.29
- typeorm (npm): affected from 0.1.12; fixed in 0.3.29

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-9ggv-8w38-r7pm/ (Markdown: https://insights.sbomify.com/GHSA-9ggv-8w38-r7pm/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-9ggv-8w38-r7pm

---
From sbomify Insights: https://insights.sbomify.com/GHSA-9ggv-8w38-r7pm/
Summaries are generated and may contain mistakes; the official description above is the record.