{"id":"GHSA-9ggv-8w38-r7pm","aliases":[],"url":"https://o3.security/vulnerability/GHSA-9ggv-8w38-r7pm","summary":"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)","details":"### Impact\n\nBlind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users.\n\n`UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not.\n\nIf any code path passes user-controlled input to `orderBy`/`addOrderBy` on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction — even when the column name itself is hardcoded.\n\nDemonstrated impact includes:\n- **Data exfiltration** via time-based blind extraction (e.g. using `SLEEP()` to infer secret values bit by bit)\n- **Row targeting manipulation** in queries using `LIMIT` patterns\n- **Denial of service** via `SLEEP()`-based query exhaustion\n\nCVSS 3.1: **8.6 (High)** — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`\n\nAffected files (relative to commit `73fda419`):\n- `src/query-builder/UpdateQueryBuilder.ts`: lines 383–419 and 718–744\n- `src/query-builder/SoftDeleteQueryBuilder.ts`: lines 352–388 and 520–546\n\nThe vulnerability was introduced in commit `03799bd2` (v0.1.12) and is present through the latest release (v0.3.28).\n\n### Patches\n\nA fix has been released in 0.3.29 (1b66c44) and 1.0.0 (93eec63).\n\n### Workarounds\n\nApplications can manually validate the `order` argument before passing it to `orderBy` or `addOrderBy` on update or soft-delete query builders:\n\n```ts\nconst direction = userInput.toUpperCase();\nif (direction !== 'ASC' && direction !== 'DESC') {\n  throw new Error('Invalid sort direction');\n}\nqb.orderBy(column, direction as 'ASC' | 'DESC');\n```\n\nDo not pass user-controlled values to `orderBy`/`addOrderBy` on `UpdateQueryBuilder` or `SoftDeleteQueryBuilder` without this validation.\n\n### References\n\n- Introduced in commit 03799bd2 (v0.1.12)\n- Confirmed present in v0.3.28 (commit 73fda419)\n- See `SelectQueryBuilder.orderBy` for the correct validation pattern this fix should mirror","published":"2026-06-19T19:18:49Z","modified":"2026-06-29T18:29:27.117185017Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"typeorm","fixedVersion":"0.3.29"}],"fix":{"url":"https://github.com/typeorm/typeorm/commit/1b66c44d0410bdc56a0dcefb46be41867ec0fffc","label":"typeorm/typeorm@1b66c44"},"references":[{"type":"WEB","url":"https://github.com/typeorm/typeorm/security/advisories/GHSA-9ggv-8w38-r7pm"},{"type":"WEB","url":"https://github.com/typeorm/typeorm/commit/1b66c44d0410bdc56a0dcefb46be41867ec0fffc"},{"type":"WEB","url":"https://github.com/typeorm/typeorm/commit/93eec630630b219b162ba4e0c072afa851697cff"},{"type":"PACKAGE","url":"https://github.com/typeorm/typeorm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-29T18:29:27.117185017Z"}}