Skip to main content
cve.nowby Sazabi
← npm
npmPackage

typeorm

4 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 medium
Registry
npm

Advisories 4

  • CVE-2026-73651Medium 5.7

    TypeORM: migration:generate template-literal code injection

    Affected: fixed in 0.3.31; from 1.0.0, fixed in 1.1.0.

  • CVE-2025-60542Medium 6.5

    SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call…

    Affected: fixed in 0.3.26.

  • The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object.

    Affected: fixed in 0.3.0.

  • Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to…

    Affected: fixed in 0.2.25.