Junglewise Threat Intelligence

Veramo SQL injection in data store ORM query filtering

Severity: low · CVSS 3.1 · Published 2026-01-16

Vendors: npm.

Executive brief

Veramo's data store component, used to query and manage verifiable credentials and identities, contains an SQL injection vulnerability in its query ordering feature. An authenticated user with network access to the Veramo agent REST API can execute arbitrary SQL queries, potentially extracting sensitive data such as private keys from the underlying database.

Technical details

The vulnerability exists in the decorateQB() function in packages/data-store/src/data-store-orm.ts (lines 416–434), which processes query ordering parameters. The item.column value from user input is passed directly as the alias parameter to TypeORM's addSelect() method without validation or sanitization. While TypeScript compile-time type definitions restrict column names (e.g., TCredentialColumns), the function accepts FindArgs<any> at runtime, allowing arbitrary strings to bypass type restrictions. TypeORM then inserts the unvalidated alias directly into the SQL query, enabling SQL injection. The vulnerability affects five data store endpoints: dataStoreORMGetIdentifiers, dataStoreORMGetMessages, dataStoreORMGetVerifiableCredentialsByClaims, dataStoreORMGetVerifiableCredentials, and dataStoreORMGetVerifiablePresentations. An authenticated attacker can execute UNION-based injection attacks to exfiltrate private keys, read arbitrary database contents, or cause denial of service. The patch in version 6.0.2 adds runtime validation of column names used for sorting.

Affected products

  • Decentralized Identity Foundation @veramo/data-store 0 through 6.0.1

Timeline

  • 2026-01-16: disclosed: Security advisory GHSA-38cw-85xc-xr9x published
  • 2026-01-16: patched: Fixed in version 6.0.2

References