Executive brief
TypeORM is a popular Node.js library used to interact with databases through an object-oriented interface. A prototype pollution vulnerability in versions before 0.2.25 allows attackers to modify object properties without authentication, potentially leading to denial of service or SQL injection attacks that could compromise database integrity or availability.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-471) affecting TypeORM versions prior to 0.2.25. The vulnerability allows attackers to add or modify JavaScript object properties through specially crafted input, bypassing normal property constraints. No authentication or user interaction is required; the vulnerability is network-accessible. Successful exploitation can lead to denial of service conditions or facilitate SQL injection attacks against the underlying database. The fix is available in version 0.2.25 and later.
Affected products
- TypeORM TypeORM <0.2.25
Timeline
- 2020-09-18: disclosed: NVD published
- 2021-05-07: advisory: GHSA advisory published
- 0.2.25: patched