Skip to content

fix(deps): update dependency typeorm to ^0.3.26 [security] #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update dependency typeorm to ^0.3.26 [security] #36

renovate wants to merge 1 commit into from
+1,369 −68

Conversation

@renovate
Copy link

@renovate renovate bot commented Mar 21, 2024 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
typeorm (source) ^0.2.18 → ^0.3.26 age confidence

GitHub Vulnerability Alerts

CVE-2022-33171

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.

CVE-2025-60542

Summary

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

Details

Vulnerable Code:

const { username, city, name} = req.body;
const updateData = {
    username,
    city,
    name,
    id:userId
  }; // Developer aims to only allow above three fields to be updated    
const result = await userRepo.save(updateData);

Intended Payload (non-malicious):

username=myusername&city=Riga&name=Javad

OR

{username:\"myusername\",phone:12345,name:\"Javad\"}

SQL query produced:

UPDATE `user` 
SET `username` = 'myusername', 
    `city` = 'Riga', 
    `name` = 'Javad' 
WHERE `id` IN (1);

Malicious Payload:

username=myusername&city[name]=Riga&city[role]=admin

OR

{username:\"myusername\",city:{name:\"Javad\",role:\"admin\"}}

SQL query produced with Injected Column:

UPDATE `user` 
SET `username` = 'myusername', 
    `city` = `name` = 'Javad', 
    `role` = 'admin' 
WHERE `id` IN (1);

Above query is valid as city = name = Javad is a boolean expression resulting in city = 1 (false). “role” column is injected and updated.

Underlying issue was due to TypeORM using mysql2 without specifying a value for the stringifyObjects option. In both mysql and mysql2 this option defaults to false. This option is then passed into SQLString library as false. This results in sqlstring parsing objects in a strange way using objectToValues.

Release Notes

typeorm/typeorm (typeorm)

v0.3.26

Compare Source

Notes:

  • When using MySQL, TypeORM now connects using stringifyObjects: true, in order to avoid a potential security vulnerability
    in the mysql/mysql2 client libraries. You can revert to the old behavior by setting connectionOptions.extra.stringifyObjects = false.
  • When using SAP HANA, TypeORM now uses the built-in pool from the @sap/hana-client library. The deprecated hdb-pool
    is no longer necessary and can be removed. See https://typeorm.io/docs/drivers/sap/#data-source-options for the new pool options.
Bug Fixes
Features
Performance Improvements

v0.3.25

Compare Source

Bug Fixes
Features

v0.3.24

Compare Source

Bug Fixes
Features
Performance Improvements
  • improve save performance during entities update (15de733)

v0.3.23

Compare Source

⚠️ Note on a breaking change

This release includes a technically breaking change (from this PR) in the behaviour of the delete and update methods of the EntityManager and Repository APIs, when an empty object is supplied as the criteria:

await repository.delete({})
await repository.update({}, { foo: 'bar' })
  • Old behaviour was to delete or update all rows in the table
  • New behaviour is to throw an error: Empty criteria(s) are not allowed for the delete/update method.

Why?

This behaviour was not documented and is considered dangerous as it can allow a badly-formed object (e.g. with an undefined id) to inadvertently delete or update the whole table.

When the intention actually was to delete or update all rows, such queries can be rewritten using the QueryBuilder API:

await repository.createQueryBuilder().delete().execute()
// executes: DELETE FROM table_name
await repository.createQueryBuilder().update().set({ foo: 'bar' }).execute()
// executes: UPDATE table_name SET foo = 'bar'

An alternative method for deleting all rows is to use:

await repository.clear()
// executes: TRUNCATE TABLE table_name
Bug Fixes
Features
Performance Improvements

v0.3.22

Compare Source

Bug Fixes
Features
Reverts

v0.3.21

Compare Source

Bug Fixes
Performance Improvements

v0.3.20

Compare Source

Bug Fixes
Features
Reverts

v0.3.19

Compare Source

Bug Fixes
  • fixed Cannot read properties of undefined (reading 'sync') caused after glob package upgrade

v0.3.18

Compare Source

Bug Fixes
Features
Performance Improvements
BREAKING CHANGES
  • With node-oracledb the thin client is used as default. Added a option to use the thick client. Also added the option to specify the instant client lib
  • MongoDB: from the previous behavior of returning a result with metadata describing when a document is not found.
    See: https://github.com/mongodb/node-mongodb-native/blob/HEAD/etc/notes/CHANGES_6.0.0.md
  • new nullable embeds feature introduced a breaking change which might enforce you to update types on your entities to | null,
    if all columns in your embed entity are nullable. Since database queries now return embedded property as null if all its column values are null.

v0.3.17

Compare Source

Bug Fixes

v0.3.16

Compare Source

Bug Fixes
Features
Reverts

v0.3.15

Compare Source

Bug Fixes
  • make cache optional fields optional (#​9942) (159c60a)
  • prevent unique index identical to primary key (all sql dialects) (#​9940) (51eecc2)
  • SelectQueryBuilder builds incorrectly escaped alias in Oracle when used on entity with composite key (#​9668) (83c6c0e)
Features

v0.3.14

Compare Source

Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from c9f8cf1 to 527758c Compare August 12, 2025 00:10
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 527758c to de7e964 Compare August 23, 2025 16:00
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from de7e964 to 19b8a54 Compare September 1, 2025 02:28
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 19b8a54 to 2984cf0 Compare September 26, 2025 23:55
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 2984cf0 to c64a93a Compare October 23, 2025 06:32
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from c64a93a to f52a6e9 Compare November 1, 2025 12:14
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.0 [security] fix(deps): update dependency typeorm to ^0.3.26 [security] Nov 1, 2025
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from f52a6e9 to bd5880f Compare November 16, 2025 07:44
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.26 [security] fix(deps): update dependency typeorm to ^0.3.0 [security] Nov 16, 2025
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch 2 times, most recently from f397066 to f163be2 Compare November 20, 2025 15:14
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.0 [security] fix(deps): update dependency typeorm to ^0.3.26 [security] Nov 20, 2025
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from f163be2 to 6ddd56a Compare December 4, 2025 19:24
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.26 [security] fix(deps): update dependency typeorm to ^0.3.0 [security] Dec 4, 2025
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 6ddd56a to 9c0894c Compare December 5, 2025 15:49
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.0 [security] fix(deps): update dependency typeorm to ^0.3.26 [security] Dec 5, 2025
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 9c0894c to 6790134 Compare December 30, 2025 11:49
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.26 [security] fix(deps): update dependency typeorm to ^0.3.0 [security] Dec 30, 2025
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 6790134 to e319cab Compare January 2, 2026 07:43
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.0 [security] fix(deps): update dependency typeorm to ^0.3.26 [security] Jan 2, 2026
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from e319cab to 7366b4c Compare January 9, 2026 15:04
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.26 [security] fix(deps): update dependency typeorm to ^0.3.0 [security] Jan 9, 2026
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 7366b4c to 1b00823 Compare January 10, 2026 07:39
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.0 [security] fix(deps): update dependency typeorm to ^0.3.26 [security] Jan 10, 2026
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 1b00823 to aed0268 Compare January 20, 2026 11:40
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.26 [security] fix(deps): update dependency typeorm to ^0.3.0 [security] Jan 20, 2026
@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from aed0268 to cf5d5a6 Compare January 21, 2026 19:24
@renovate renovate bot changed the title fix(deps): update dependency typeorm to ^0.3.0 [security] fix(deps): update dependency typeorm to ^0.3.26 [security] Jan 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant