Vulnerabilities

 1 via 1 paths

Dependencies

 258

Source

 GitHub

Commit

 6e7197d2

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity
new

SQL Injection

  • Vulnerable module: typeorm
  • Introduced through: typeorm@0.3.25

Detailed paths

  • Introduced through: prime-nestjs@joeygoksu/prime-nestjs#6e7197d2546e0bbacb79e9ad43c6e92b6e430f5c › typeorm@0.3.25
    Remediation: Upgrade to typeorm@0.3.26.

Overview

typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript (ES5, ES6, ES7, ES8).

Affected versions of this package are vulnerable to SQL Injection via the repository.save or repository.update features when processing crafted input, due to improper handling in the sqlstring call with stringifyObjects set to false. An attacker can execute arbitrary SQL commands to bypass field-level update restrictions for columns such as user roles, by supplying specially crafted nested JSON.

Remediation

Upgrade typeorm to version 0.3.26 or higher.

References

SQL Injection vulnerability report