SQL Injection Vulnerability in TypeORM by TypeORM
CVE-2025-60542

6.5MEDIUM

Key Information:

Vendor

TypeORM

Status
TypeORM
Vendor
CVE Published:
29 October 2025

What is CVE-2025-60542?

An SQL Injection vulnerability exists in TypeORM prior to version 0.3.26. This issue arises when crafted requests are sent to the repository.save or repository.update functions. The vulnerability is triggered due to the sqlstring call failing to properly utilize stringifyObjects as true, allowing attackers to manipulate database queries. It is crucial for users of the affected versions to update their installations to mitigate potential security risks.

References

https://github.com/typeorm/typeorm/releases?q=security&ex...
https://github.com/typeorm/typeorm/pull/11574
https://github.com/typeorm/typeorm/releases/tag/0.3.26

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.