Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 19 June 2026.

Which products and versions are affected?

typeorm (npm) SEMVER:introduced=0.1.12,fixed=0.3.29.

Is there a fix for This vulnerability?

Yes. typeorm (npm): upgrade to 0.3.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run typeorm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

TypeORM SQL injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy

Severity: low · CVSS 3.1 · Published 2026-06-19

TypeORM is a popular Object-Relational Mapping (ORM) library used to interact with databases in Node.js applications. The UpdateQueryBuilder and SoftDeleteQueryBuilder components fail to validate the sort direction parameter (orderBy/addOrderBy), allowing attackers to inject arbitrary SQL commands. When user-controlled input reaches these functions in MySQL or MariaDB, an attacker can extract sensitive data through time-based blind SQL injection, manipulate which rows are affected by updates, or cause denial of service.

Technologies: typeorm (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 19 June 2026.
Which products and versions are affected?: typeorm (npm) SEMVER:introduced=0.1.12,fixed=0.3.29.
Is there a fix for This vulnerability?: Yes. typeorm (npm): upgrade to 0.3.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run typeorm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

typeorm (npm): upgrade to 0.3.29 or later
```
npm install typeorm@0.3.29
```

Technical details

This is a SQL injection vulnerability (CWE-89) in TypeORM's UpdateQueryBuilder and SoftDeleteQueryBuilder query builders affecting MySQL and MariaDB databases. The vulnerable code fails to validate the order parameter against an allowlist of permitted values (ASC/DESC); instead, it concatenates the user-supplied value directly into the generated SQL string without quoting or parameterization. The vulnerability exists in both orderBy and addOrderBy methods. Attack requires network access but no authentication or user interaction. An attacker who can pass user-controlled input to these methods can inject arbitrary SQL to extract data via time-based blind extraction (using SLEEP()), manipulate row targeting with LIMIT patterns, or cause denial of service. Patches are available in versions 0.3.29 and 1.0.0 (commits 1b66c44 and 93eec63). The bug was introduced in v0.1.12 and affects all versions through v0.3.28.

Affected products

TypeORM TypeORM 0.1.12 through 0.3.28

Timeline

2026-06-19: disclosed: GHSA-9ggv-8w38-r7pm published
2026-06-19: patched: Fix released in versions 0.3.29 and 1.0.0
2026-05-07: other: Fix commits authored (1b66c44 for 0.3.29, 93eec63 for 1.0.0)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.