Skip to content

chore(deps): update dependency typeorm to v0.3.26 [security]#1131

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-typeorm-vulnerability
Open

chore(deps): update dependency typeorm to v0.3.26 [security]#1131
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-typeorm-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 6, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
typeorm (source) 0.3.17 → 0.3.26 age confidence

TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

CVE-2025-60542 / GHSA-q2pj-6v73-8rgj

More information

Details

Summary

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

Details

Vulnerable Code:

const { username, city, name} = req.body;
const updateData = {
    username,
    city,
    name,
    id:userId
  }; // Developer aims to only allow above three fields to be updated    
const result = await userRepo.save(updateData);

Intended Payload (non-malicious):

username=myusername&city=Riga&name=Javad

OR

{username:\"myusername\",phone:12345,name:\"Javad\"}

SQL query produced:

UPDATE `user` 
SET `username` = 'myusername', 
    `city` = 'Riga', 
    `name` = 'Javad' 
WHERE `id` IN (1);

Malicious Payload:

username=myusername&city[name]=Riga&city[role]=admin

OR

{username:\"myusername\",city:{name:\"Javad\",role:\"admin\"}}

SQL query produced with Injected Column:

UPDATE `user` 
SET `username` = 'myusername', 
    `city` = `name` = 'Javad', 
    `role` = 'admin' 
WHERE `id` IN (1);

Above query is valid as city = name = Javad is a boolean expression resulting in city = 1 (false). “role” column is injected and updated.

Underlying issue was due to TypeORM using mysql2 without specifying a value for the stringifyObjects option. In both mysql and mysql2 this option defaults to false. This option is then passed into SQLString library as false. This results in sqlstring parsing objects in a strange way using objectToValues.

Severity

  • CVSS Score: 8.9 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:H/SA:L/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

typeorm/typeorm (typeorm)

v0.3.26

Compare Source

Notes:

  • When using MySQL, TypeORM now connects using stringifyObjects: true, in order to avoid a potential security vulnerability
    in the mysql/mysql2 client libraries. You can revert to the old behavior by setting connectionOptions.extra.stringifyObjects = false.
  • When using SAP HANA, TypeORM now uses the built-in pool from the @sap/hana-client library. The deprecated hdb-pool
    is no longer necessary and can be removed. See https://typeorm.io/docs/drivers/sap/#data-source-options for the new pool options.
Bug Fixes
Features
Performance Improvements

v0.3.25

Compare Source

Bug Fixes
Features

v0.3.24

Compare Source

Bug Fixes
Features
Performance Improvements
  • improve save performance during entities update (15de733)

v0.3.23

Compare Source

⚠️ Note on a breaking change

This release includes a technically breaking change (from this PR) in the behaviour of the delete and update methods of the EntityManager and Repository APIs, when an empty object is supplied as the criteria:

await repository.delete({})
await repository.update({}, { foo: 'bar' })
  • Old behaviour was to delete or update all rows in the table
  • New behaviour is to throw an error: Empty criteria(s) are not allowed for the delete/update method.

Why?

This behaviour was not documented and is considered dangerous as it can allow a badly-formed object (e.g. with an undefined id) to inadvertently delete or update the whole table.

When the intention actually was to delete or update all rows, such queries can be rewritten using the QueryBuilder API:

await repository.createQueryBuilder().delete().execute()
// executes: DELETE FROM table_name
await repository.createQueryBuilder().update().set({ foo: 'bar' }).execute()
// executes: UPDATE table_name SET foo = 'bar'

An alternative method for deleting all rows is to use:

await repository.clear()
// executes: TRUNCATE TABLE table_name
Bug Fixes
Features
Performance Improvements

v0.3.22

Compare Source

Bug Fixes
Features
Reverts

v0.3.21

Compare Source

Bug Fixes
Performance Improvements

v0.3.20

Compare Source

Bug Fixes
Features
Reverts

v0.3.19

Compare Source

Bug Fixes
  • fixed Cannot read properties of undefined (reading 'sync') caused after glob package upgrade

v0.3.18

Compare Source

Bug Fixes
Features
Performance Improvements
BREAKING CHANGES
  • With node-oracledb the thin client is used as default. Added a option to use the thick client. Also added the option to specify the instant client lib
  • MongoDB: from the previous behavior of returning a result with metadata describing when a document is not found.
    See: https://github.com/mongodb/node-mongodb-native/blob/HEAD/etc/notes/CHANGES_6.0.0.md
  • new nullable embeds feature introduced a breaking change which might enforce you to update types on your entities to | null,
    if all columns in your embed entity are nullable. Since database queries now return embedded property as null if all its column values are null.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/npm-typeorm-vulnerability branch from 7f46ece to ea57e5a Compare March 14, 2026 21:54
@renovate renovate Bot changed the title chore(deps): update dependency typeorm to v0.3.26 [security] chore(deps): update dependency typeorm to v0.3.26 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/npm-typeorm-vulnerability branch March 27, 2026 02:10
@renovate renovate Bot changed the title chore(deps): update dependency typeorm to v0.3.26 [security] - autoclosed chore(deps): update dependency typeorm to v0.3.26 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/npm-typeorm-vulnerability branch from ea57e5a to a5f058c Compare March 30, 2026 22:29
@renovate renovate Bot force-pushed the renovate/npm-typeorm-vulnerability branch 3 times, most recently from df3f5ed to ea030d5 Compare April 13, 2026 07:20
@renovate renovate Bot force-pushed the renovate/npm-typeorm-vulnerability branch 3 times, most recently from fe5bd38 to 5b9e186 Compare April 24, 2026 08:00
@renovate renovate Bot changed the title chore(deps): update dependency typeorm to v0.3.26 [security] chore(deps): update dependency typeorm to v0.3.26 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title chore(deps): update dependency typeorm to v0.3.26 [security] - autoclosed chore(deps): update dependency typeorm to v0.3.26 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/npm-typeorm-vulnerability branch 3 times, most recently from 015544d to b11e184 Compare April 28, 2026 10:25
@renovate renovate Bot force-pushed the renovate/npm-typeorm-vulnerability branch from b11e184 to 51bc742 Compare April 29, 2026 16:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants