GCVE - cpe:2.3:a:typeorm:typeorm:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:typeorm:typeorm:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-33171`	vulnerable	2026-06-08 05:44:46.320628	Details available The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation Published: 2022-07-04T15:51:49.000Z Updated: 2024-08-03T08:01:20.214Z Open on db.gcve.eu Reference links https://github.com/typeorm/typeorm/compare/0.2.45...0.3.0 https://seclists.org/fulldisclosure/2022/Jun/51 http://seclists.org/fulldisclosure/2022/Aug/7 http://packetstormsecurity.com/files/168096/TypeORM-0.3.7-Information-Disclosure.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-8158`	vulnerable	2026-06-08 05:27:14.982880	Details available Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks. Published: 2020-09-18T20:12:16.000Z Updated: 2024-08-04T09:48:25.595Z Open on db.gcve.eu Reference links https://hackerone.com/reports/869574	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.