AIKIDO-2025-10205
typeorm is vulnerable to Improper String Escaping
70
High Risk
This Affects:
typeormTL;DR
Affected versions of this package lack sufficient backlash and single quote escaping in the methods used for drives, migrations, and query runners. It unsafely utilizes String.replace() for escaping, which fails to handle repeated special characters or escape sequences properly. This vulnerability allows attackers to create malicious input with unescaped special characters, potentially breaking the query syntax and enabling SQL injection attacks if the improperly escaped string is handled in a critical context.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
typeorm is vulnerable to Improper String Escaping in versions 0.3.0 - 0.3.21.
How to fix this
Upgrade the TypeORM library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant