> CVE-2025-60542

« BACK_TO_HOME
PUBLISHED
2025-10-29 16:15
MODIFIED
2025-10-29 16:15
EPSS (Prob. Exploit)
0.27%
Top 82.5%
DATA SOURCES:
NVD 🔗 2025-10-29 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Developer Hub 1.7.3 release.
Red Hat Developer Hub 1.7.3 has been released.
Red Hat Security Advisory: Red Hat Developer Hub 1.8.1 release.
Red Hat Developer Hub 1.8.1 has been released.

> GITHUB SECURITY ADVISORY

GHSA-q2pj-6v73-8rgj HIGH

TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

AFFECTED PACKAGES:
NPM / typeorm
< 0.3.26
Fixed in: 0.3.26

> HISTORIQUE DES MODIFICATIONS

Première apparition
29/10/2025 16:15
Source: NVD
📊 ENRICHISSEMENT 19/01/2026 17:36
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/typeorm/typeorm/pull/11574
https://github.com/typeorm/typeorm/releases/tag/0.3.26
https://github.com/typeorm/typeorm/releases?q=security&expanded=true
https://medium.com/@alizada.cavad/cve-2025-60542-typeorm-mysql-sqli-0-3-25-a1b32...
« BACK_TO_HOME