GHSA-w7q7-vjp8-7jv4 SQL Injection in typeorm
Attackers can inject SQL statements via unvalidated field names in TypeORM, allowing arbitrary query execution and data manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-w7q7-vjp8-7jv4?
GHSA-w7q7-vjp8-7jv4 is a SQL injection vulnerability in typeorm, published on 6 Jun 2019. It can be exploited over the network, with no action from the victim.
Official description
Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.
Recommendation
Upgrade to version 0.1.15
Which versions are affected by GHSA-w7q7-vjp8-7jv4?
2 open source packages ship an affected version, including typeorm.
| Package | Affected | Fixed in |
|---|---|---|
typeorm npm | All versions | 0.1.15 |
typeorm npm | All versions | 0.1.15 |
How do I fix GHSA-w7q7-vjp8-7jv4?
Upgrade typeorm to 0.1.15 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-w7q7-vjp8-7jv4 being exploited?
There is no known exploitation of GHSA-w7q7-vjp8-7jv4 in the wild and no public exploit code.