Executive brief
TypeORM is a popular Object-Relational Mapping (ORM) library used to interact with databases in Node.js applications. The UpdateQueryBuilder and SoftDeleteQueryBuilder components fail to validate the sort direction parameter (orderBy/addOrderBy), allowing attackers to inject arbitrary SQL commands. When user-controlled input reaches these functions in MySQL or MariaDB, an attacker can extract sensitive data through time-based blind SQL injection, manipulate which rows are affected by updates, or cause denial of service.
Technical details
This is a SQL injection vulnerability (CWE-89) in TypeORM's UpdateQueryBuilder and SoftDeleteQueryBuilder query builders affecting MySQL and MariaDB databases. The vulnerable code fails to validate the order parameter against an allowlist of permitted values (ASC/DESC); instead, it concatenates the user-supplied value directly into the generated SQL string without quoting or parameterization. The vulnerability exists in both orderBy and addOrderBy methods. Attack requires network access but no authentication or user interaction. An attacker who can pass user-controlled input to these methods can inject arbitrary SQL to extract data via time-based blind extraction (using SLEEP()), manipulate row targeting with LIMIT patterns, or cause denial of service. Patches are available in versions 0.3.29 and 1.0.0 (commits 1b66c44 and 93eec63). The bug was introduced in v0.1.12 and affects all versions through v0.3.28.
Affected products
- TypeORM TypeORM 0.1.12 through 0.3.28
Timeline
- 2026-06-19: disclosed: GHSA-9ggv-8w38-r7pm published
- 2026-06-19: patched: Fix released in versions 0.3.29 and 1.0.0
- 2026-05-07: other: Fix commits authored (1b66c44 for 0.3.29, 93eec63 for 1.0.0)