{"id":"CVE-2025-32020","aliases":["GHSA-9r25-rp3p-h2w4"],"url":"https://o3.security/vulnerability/CVE-2025-32020","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser","details":"### Impact\n\nImproper neutralization of the `order`/`sort` parameter in the TypeORM adapter, which allows SQL injection.\n\nYou are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.\n\nVersions 0.0.1, 0.0.2 and 0.0.3 are affected by this vulnerability.\n\n### Patches\n\nThis vulnerability has been fixed in version 0.1.0 and newer, which introduces TypeORM field validation (enabled by default).\n\n### Workarounds\n\n#### Add an allowlist of fields\nList all valid fields and use the `filterProperties` function to filter out invalid fields before passing the crudRequest to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest = filterProperties(crudRequest, ['id', 'title', 'category.name']);\n```\n\n#### Disable ordering\nCleanup the `order` field just before passing it to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest.order = [];\n```","published":"2025-04-08T15:05:26.333Z","modified":"2026-10-28T02:30:44.111293127Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"crud-query-parser","fixedVersion":"0.1.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32020.json"},{"type":"ADVISORY","url":"https://github.com/Guichaguri/crud-query-parser/security/advisories/GHSA-9r25-rp3p-h2w4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32020"},{"type":"PACKAGE","url":"https://github.com/Guichaguri/crud-query-parser"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:44.111293127Z"}}