CVE-2025-60542: TypeORM SQL injection in repository.save and repository.update

CVE-2025-60542 · Severity: medium · CVSS 6.5 · Published 2025-10-29

TypeORM is a popular object-relational mapping (ORM) library used by developers to interact with databases in Node.js applications. A SQL injection vulnerability allows attackers to inject malicious SQL commands by crafting specially-formed object payloads in repository.save() or repository.update() operations, potentially leading to unauthorized data modification or exposure. This affects applications using TypeORM versions before 0.3.26 with MySQL or MySQL2 database drivers.

Technologies: typeorm (npm). Vendors: npm.

Quick answers

Is CVE-2025-60542 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-60542 being exploited in the wild.
How severe is CVE-2025-60542?
Medium severity, with a CVSS score of 6.5, published 29 October 2025.
Which products and versions are affected?
typeorm (npm) SEMVER:introduced=0,fixed=0.3.26.
Is there a fix for CVE-2025-60542?
Yes. typeorm (npm): upgrade to 0.3.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-60542 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-60542?
Check whether you run typeorm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • typeorm (npm): upgrade to 0.3.26 or later
    npm install typeorm@0.3.26

Technical details

This is a SQL injection vulnerability (CWE-89) in TypeORM's MySQL driver caused by incorrect configuration of the mysql2 client library. The root cause is that TypeORM does not explicitly set the stringifyObjects option when initializing mysql2, causing it to default to false. This default behavior causes the underlying sqlstring library to parse plain JavaScript objects into malformed SQL syntax, allowing attackers to inject additional column assignments. An attacker can exploit this by sending a request with a nested object in request.body (e.g., city[name] and city[role]) which are then passed directly to repository.save() or repository.update(). The vulnerability requires network access to the application and no authentication, but does require the application to pass user-controlled data directly into the ORM methods without filtering. The fix sets stringifyObjects: true explicitly, which is available in TypeORM 0.3.26 and later.

Affected products

  • TypeORM TypeORM before 0.3.26

Identifiers

  • CVE-2025-60542
  • GHSA-q2pj-6v73-8rgj

Timeline

  • 2025-10-29: disclosed
  • 2025-10-29: patched: Fixed in version 0.3.26
  • 2025-10-31: advisory: GHSA-q2pj-6v73-8rgj published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.