# CVE-2025-60542: TypeORM SQL injection in repository.save and repository.update

Source: https://junglewise.ai/threats/cve-2025-60542-typeorm-sql-injection-in-repository-save-and-repository-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-60542 · Severity: medium · CVSS 6.5 · Published 2025-10-29

TypeORM is a popular object-relational mapping (ORM) library used by developers to interact with databases in Node.js applications. A SQL injection vulnerability allows attackers to inject malicious SQL commands by crafting specially-formed object payloads in repository.save() or repository.update() operations, potentially leading to unauthorized data modification or exposure. This affects applications using TypeORM versions before 0.3.26 with MySQL or MySQL2 database drivers.

Technologies: [typeorm (npm)](https://junglewise.ai/threats/technologies/typeorm). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-60542 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60542 being exploited in the wild.

**How severe is CVE-2025-60542?** Medium severity, with a CVSS score of 6.5, published 29 October 2025.

**Which products and versions are affected?** typeorm (npm) SEMVER:introduced=0,fixed=0.3.26.

**Is there a fix for CVE-2025-60542?** Yes. typeorm (npm): upgrade to 0.3.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-60542 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-60542?** Check whether you run typeorm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- typeorm (npm): upgrade to 0.3.26 or later

  ```sh
  npm install typeorm@0.3.26
  ```


## Technical details

This is a SQL injection vulnerability (CWE-89) in TypeORM's MySQL driver caused by incorrect configuration of the mysql2 client library. The root cause is that TypeORM does not explicitly set the stringifyObjects option when initializing mysql2, causing it to default to false. This default behavior causes the underlying sqlstring library to parse plain JavaScript objects into malformed SQL syntax, allowing attackers to inject additional column assignments. An attacker can exploit this by sending a request with a nested object in request.body (e.g., city[name] and city[role]) which are then passed directly to repository.save() or repository.update(). The vulnerability requires network access to the application and no authentication, but does require the application to pass user-controlled data directly into the ORM methods without filtering. The fix sets stringifyObjects: true explicitly, which is available in TypeORM 0.3.26 and later.

## Affected products

- TypeORM TypeORM before 0.3.26

## Identifiers

- CVE-2025-60542
- GHSA-q2pj-6v73-8rgj

## Timeline

- 2025-10-29: disclosed
- 2025-10-29: patched: Fixed in version 0.3.26
- 2025-10-31: advisory: GHSA-q2pj-6v73-8rgj published

## References

- [https://github.com/typeorm/typeorm/pull/11574](https://github.com/typeorm/typeorm/pull/11574)

## Related threats

- [TypeORM migration:generate template-literal code injection](https://junglewise.ai/threats/cve-2026-73651-typeorm-migration-generate-template-literal-code-injection)
- [TypeORM SQL injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy](https://junglewise.ai/threats/typeorm-sql-injection-in-updatequerybuilder-softdeletequerybuilder-9de71c2e)
- [TypeORM SQL injection in findOne](https://junglewise.ai/threats/cve-2022-33171-typeorm-sql-injection-in-findone)
- [TypeORM prototype pollution](https://junglewise.ai/threats/cve-2020-8158-typeorm-prototype-pollution)
- [typeorm SQL Injection via unvalidated field names](https://junglewise.ai/threats/typeorm-sql-injection-via-unvalidated-field-names-8d623bc7)