CVE-2025-60542: TypeORM SQL Injection Vulnerability

CVE-2025-60542 Overview

CVE-2025-60542 is a SQL Injection vulnerability [CWE-89] in TypeORM versions prior to 0.3.26. The flaw exists in the object-relational mapping (ORM) layer used by Node.js applications to interact with relational databases. Attackers can exploit it by sending crafted requests to repository.save or repository.update operations. The underlying cause is that TypeORM invokes the sqlstring library with the stringifyObjects option defaulting to false, allowing nested object payloads to break out of parameterized query context. Successful exploitation can lead to unauthorized data disclosure or modification within the backing database.

Critical Impact
Remote attackers can inject SQL statements through nested object payloads submitted to repository.save or repository.update, enabling unauthorized read or write access to database records without authentication.

Affected Products

TypeORM versions prior to 0.3.26
Node.js applications using TypeORM with MySQL driver
Applications passing user-controlled input directly to repository.save or repository.update

Discovery Timeline

2025-10-29 - CVE-2025-60542 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60542

Vulnerability Analysis

TypeORM is a widely used TypeScript and JavaScript ORM that abstracts SQL query construction for developers. The vulnerability arises when the ORM builds SQL statements for repository.save and repository.update calls. Internally, TypeORM relies on the sqlstring package to escape values before embedding them into the final query. The sqlstring.format and sqlstring.escape functions accept a stringifyObjects parameter that controls how nested JavaScript objects are serialized. When stringifyObjects is false, which is the default TypeORM used before version 0.3.26, sqlstring treats nested object keys as SQL identifiers and their values as separate escapable expressions. An attacker who controls a nested object structure can therefore introduce syntax that alters the intended SQL semantics.

Root Cause

The root cause is unsafe default configuration [CWE-89]. TypeORM passed user-controlled structured input into sqlstring without setting stringifyObjects to true, causing object values to be interpreted as key-value SQL fragments rather than opaque strings. Any endpoint that forwards a JSON request body directly to repository.save or repository.update inherits this behavior.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a request containing a nested object where TypeORM expects a scalar value. When the ORM constructs the resulting INSERT or UPDATE statement, the crafted object is expanded into attacker-controlled SQL fragments. Depending on the schema and driver in use, this can be leveraged to modify WHERE conditions, alter column assignments, or extract data through error-based or boolean-based inference. Public analysis of the flaw is documented in the Medium CVE-2025-60542 Analysis and the upstream GitHub Pull Request.

Detection Methods for CVE-2025-60542

Indicators of Compromise

Application logs showing repository.save or repository.update calls with unexpected nested object structures in user input fields.
Database query logs containing SQL fragments with unusual identifier-value pairs generated from user-supplied JSON payloads.
Anomalous UPDATE or INSERT statements affecting columns outside the normal application workflow.

Detection Strategies

Perform a software composition analysis (SCA) scan across Node.js projects to identify any typeorm dependency with a version below 0.3.26 in package.json and package-lock.json.
Enable database query logging and flag statements where nested object serialization produces SQL keywords such as OR, AND, or subqueries inside value positions.
Add web application firewall (WAF) signatures that inspect JSON request bodies for nested objects submitted to endpoints backed by TypeORM persistence methods.

Monitoring Recommendations

Instrument application-layer telemetry to capture request payload schemas reaching ORM write operations and alert when structure deviates from expected types.
Monitor authentication and data-access audit trails for unexpected privilege changes or bulk record modifications that could indicate injection-driven tampering.
Track outbound database error rates, since exploitation attempts against MySQL typically generate syntax errors before a working payload is refined.

How to Mitigate CVE-2025-60542

Immediate Actions Required

Upgrade TypeORM to version 0.3.26 or later across all Node.js services, then rebuild and redeploy affected applications.
Audit all controllers and services that pass request bodies directly into repository.save or repository.update and enforce strict schema validation before persistence.
Rotate any database credentials used by applications that were internet-exposed while running a vulnerable TypeORM version.

Patch Information

The TypeORM maintainers addressed the vulnerability in the GitHub Release 0.3.26. The fix is implemented in the GitHub Pull Request and sets stringifyObjects to true when invoking sqlstring, ensuring nested objects are serialized as opaque values. Additional maintenance notes are available under GitHub Security Releases.

Workarounds

Validate and coerce all fields passed to repository.save and repository.update to primitive types using a schema validator such as zod, joi, or class-validator before invoking the ORM.
Reject request bodies that contain nested objects for columns declared as scalar types in the entity definition.
Apply principle-of-least-privilege database roles so that the account used by the application cannot execute schema-altering or cross-table statements beyond its functional requirements.

bash

# Upgrade TypeORM to the patched release
npm install typeorm@^0.3.26
npm audit --production