CVE-2022-33171: SQL Injection in TypeORM
Summary
CVE-2022-33171: SQL injection in typeORM. Affects typeorm versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TypeORM is an Object Relational Mapping (ORM) library for TypeScript and JavaScript that enables developers to work with databases using object-oriented programming techniques. It provides a set of powerful features for querying, inserting, updating, and deleting data from various database systems. However, a vulnerability has been discovered in TypeORM versions prior to 0.3.0 that allows for SQL injection attacks.
Vulnerability Detail
The vulnerability (CVE-2022-33171) arises from the findOne function in TypeORM, which can accept either a string or a FindOneOptions object as input. When a user-controlled parsed JSON object is passed to the function, if a crafted FindOneOptions object is supplied instead of a simple id string, it can lead to SQL injection. This means that an attacker can manipulate the input to execute arbitrary SQL queries, potentially gaining unauthorized access to the database or modifying its contents. It is important to note that the vendor places the responsibility of input validation on the user's application.
How To Fix
Latest published version: 1.1.2 as of 22 Oct 2026
npm install typeorm@1.1.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
npm install typeorm@0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of TypeORM is not immediately feasible, developers can implement input validation and sanitization measures to mitigate the risk of SQL injection. This involves carefully validating and sanitizing user input before passing it to the findOne function. Implementing parameterized queries or using prepared statements can also help prevent SQL injection attacks.
Conclusion
The SQL injection vulnerability in TypeORM (CVE-2022-33171) can have severe consequences, including unauthorized access to the database and data manipulation. It is crucial to upgrade to the patched version of TypeORM (0.3.0 or later) or implement input validation and sanitization measures to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typeorm →
FAQ
TypeORM is an Object Relational Mapping (ORM) library for TypeScript and JavaScript that simplifies database interactions by mapping database tables to classes and objects.
SQL injection is a type of security vulnerability where an attacker can manipulate input data to execute arbitrary SQL queries, potentially compromising the security and integrity of a database.
The vulnerability in TypeORM occurs when a user-controlled parsed JSON object is passed to the findOne function as input. If a crafted FindOneOptions object is supplied instead of a simple id string, it can lead to SQL injection.
The SQL injection vulnerability in TypeORM can allow an attacker to execute arbitrary SQL queries, potentially gaining unauthorized access to the database, extracting sensitive information, or modifying its contents.
To protect your application from SQL injection attacks, it is important to implement proper input validation and sanitization techniques. Additionally, using parameterized queries or prepared statements can help prevent SQL injection vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for typeorm.
