typeorm

Data-Mapper ORM for TypeScript and ES2023+. Supports MySQL/MariaDB, PostgreSQL, MS SQL Server, Oracle, SAP HANA, SQLite, MongoDB databases.

Latest 1.1.2

NPM

88%

Total Score

healthy

Active releases, nine recent contributors, and an organization-backed repository make this a strong release.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 11 workflows were analyzed with no untrusted checkout or script-injection findings, but a high-confidence unpinned latest container image is a real reproducibility concern; adhoc package installation is a smaller hygiene issue, while the low-confidence cache finding is limited.

Vulnerabilities

Title	Versions	Severity
CVE-2026-73651 typeorm is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 0.3.31 and 1.0.0 - 1.1.0.	0.0.0 - 0.3.311.0.0 - 1.1.0	Medium
CVE-2025-60542 typeorm is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 0.3.26.	0.0.0 - 0.3.26	Medium
AIKIDO-2025-10205 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. typeorm is vulnerable to Improper String Escaping in versions 0.3.0 - 0.3.21.	0.3.0 - 0.3.21	High
CVE-2022-33171 typeorm is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 0.3.0.	0.0.0 - 0.3.0	Critical
CVE-2020-8158 typeorm is vulnerable to Modification of Assumed-Immutable Data (MAID) in versions 0.0.0 - 0.2.25.	0.0.0 - 0.2.25	Critical