GHSA-w7q7-vjp8-7jv4 is a critical-severity (CVSS 9.8) vulnerability in typeorm. A fix is available for typeorm — see the affected versions and patch details below.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
typeormnpmDescription
Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.
Recommendation
Upgrade to version 0.1.15
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | typeorm | all versions | 0.1.15npm install typeorm@0.1.15 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for typeorm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update typeorm to 0.1.15 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-w7q7-vjp8-7jv4 is resolved across your whole dependency graph.
Workarounds
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.
Frequently Asked Questions
Is GHSA-w7q7-vjp8-7jv4 in your dependencies?
Find it across npm, including transitive dependencies.