{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.28"
      },
      "package": {
        "ecosystem": "npm",
        "name": "typeorm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.12"
            },
            {
              "fixed": "0.3.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T19:18:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nBlind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users.\n\n`UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not.\n\nIf any code path passes user-controlled input to `orderBy`/`addOrderBy` on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction \u2014 even when the column name itself is hardcoded.\n\nDemonstrated impact includes:\n- **Data exfiltration** via time-based blind extraction (e.g. using `SLEEP()` to infer secret values bit by bit)\n- **Row targeting manipulation** in queries using `LIMIT` patterns\n- **Denial of service** via `SLEEP()`-based query exhaustion\n\nCVSS 3.1: **8.6 (High)** \u2014 `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`\n\nAffected files (relative to commit `73fda419`):\n- `src/query-builder/UpdateQueryBuilder.ts`: lines 383\u2013419 and 718\u2013744\n- `src/query-builder/SoftDeleteQueryBuilder.ts`: lines 352\u2013388 and 520\u2013546\n\nThe vulnerability was introduced in commit `03799bd2` (v0.1.12) and is present through the latest release (v0.3.28).\n\n### Patches\n\nA fix has been released in 0.3.29 (1b66c44) and 1.0.0 (93eec63).\n\n### Workarounds\n\nApplications can manually validate the `order` argument before passing it to `orderBy` or `addOrderBy` on update or soft-delete query builders:\n\n```ts\nconst direction = userInput.toUpperCase();\nif (direction !== \u0027ASC\u0027 \u0026\u0026 direction !== \u0027DESC\u0027) {\n  throw new Error(\u0027Invalid sort direction\u0027);\n}\nqb.orderBy(column, direction as \u0027ASC\u0027 | \u0027DESC\u0027);\n```\n\nDo not pass user-controlled values to `orderBy`/`addOrderBy` on `UpdateQueryBuilder` or `SoftDeleteQueryBuilder` without this validation.\n\n### References\n\n- Introduced in commit 03799bd2 (v0.1.12)\n- Confirmed present in v0.3.28 (commit 73fda419)\n- See `SelectQueryBuilder.orderBy` for the correct validation pattern this fix should mirror",
  "id": "GHSA-9ggv-8w38-r7pm",
  "modified": "2026-06-19T19:18:49Z",
  "published": "2026-06-19T19:18:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/typeorm/typeorm/security/advisories/GHSA-9ggv-8w38-r7pm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typeorm/typeorm/commit/1b66c44d0410bdc56a0dcefb46be41867ec0fffc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typeorm/typeorm/commit/93eec630630b219b162ba4e0c072afa851697cff"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/typeorm/typeorm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)"
}