{"id":"EUVD-2025-36689","enisaUuid":"1957c6c5-943d-3a53-b04a-b4c0e28b99e5","description":"SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.","datePublished":"Oct 29, 2025, 12:00:00 AM","dateUpdated":"Oct 30, 2025, 8:28:41 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/typeorm/typeorm/releases?q\u003dsecurity\u0026expanded\u003dtrue\nhttps://github.com/typeorm/typeorm/pull/11574\nhttps://github.com/typeorm/typeorm/releases/tag/0.3.26\nhttps://medium.com/@alizada.cavad/cve-2025-60542-typeorm-mysql-sqli-0-3-25-a1b32bc60453\n","aliases":"CVE-2025-60542\nGHSA-q2pj-6v73-8rgj\n","assigner":"mitre","epss":0.26,"enisaIdProduct":[{"id":"d27c38a1-ad89-3e7d-b854-9d31910ae517","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"fa429c19-6a87-3a77-9f3a-5d23ba5aad33","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"92b758c2-873a-39f3-afad-5da9c8951e45","vulnerability":{"id":"CVE-2025-60542","description":"SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.","datePublished":"Oct 29, 2025, 12:00:00 AM","dateUpdated":"Oct 30, 2025, 8:28:41 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/typeorm/typeorm/releases?q\u003dsecurity\u0026expanded\u003dtrue\nhttps://github.com/typeorm/typeorm/pull/11574\nhttps://github.com/typeorm/typeorm/releases/tag/0.3.26\nhttps://medium.com/@alizada.cavad/cve-2025-60542-typeorm-mysql-sqli-0-3-25-a1b32bc60453\n","enisa_id":"EUVD-2025-36689\n","assigner":"mitre","epss":0.26,"dataProcessed":"Nov 1, 2026, 1:37:57 AM","vulnerabilityProduct":[{"id":"4828691b-a035-30d8-a3fc-bf58a17f58b8","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"cad7ee82-b362-3688-8efe-2499617d6ff8","vendor":{"name":"n/a"}}]}},{"id":"d41cce50-10ca-3e71-984d-17f48d47a0b3","vulnerability":{"id":"GHSA-q2pj-6v73-8rgj","description":"TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update","datePublished":"Oct 29, 2025, 6:30:33 PM","dateUpdated":"Oct 31, 2025, 5:38:00 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-60542\nhttps://github.com/typeorm/typeorm/pull/11574\nhttps://github.com/typeorm/typeorm/commit/d57fe3bd8578b0b8f9847647fd046bccf825a7ef\nhttps://github.com/mysqljs/sqlstring/blob/cd528556b4b6bcf300c3db515026935dedf7cfa1/lib/SqlString.js#L54\nhttps://github.com/sidorares/node-mysql2/blob/e359f454a76ba5dc31b91adf7bdb4099ca317bb5/lib/base/connection.js#L524\nhttps://github.com/sidorares/node-mysql2/blob/e359f454a76ba5dc31b91adf7bdb4099ca317bb5/lib/connection_config.js#L124\nhttps://github.com/typeorm/typeorm/blob/0.3.25/src/driver/mysql/MysqlConnectionOptions.ts\nhttps://github.com/typeorm/typeorm/releases/tag/0.3.26\nhttps://github.com/typeorm/typeorm/releases?q\u003dsecurity\u0026expanded\u003dtrue\nhttps://medium.com/@alizada.cavad/cve-2025-60542-typeorm-mysql-sqli-0-3-25-a1b32bc60453\nhttp://github.com/typeorm/typeorm\n","enisa_id":"EUVD-2025-36689\n","aliases":"CVE-2025-60542\nGHSA-q2pj-6v73-8rgj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"12b13dea-d2b2-30f4-b366-395f843d06e1","advisory":{"id":"WID-SEC-W-2025-2702","description":"Red Hat Enterprise Linux (Developer Hub): Schwachstelle ermöglicht Manipulation von Dateien","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux Developer Hub ausnutzen, um eine SQL-Injection durchzuführen und möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu ändern oder Berechtigungen zu erweitern.","datePublished":"Nov 30, 2025, 11:00:00 PM","dateUpdated":"Dec 8, 2025, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2702.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-2702\n","aliases":"CVE-2025-60542\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"76dce045-dc33-39bc-aab9-a20297fe3abb","product":{"name":"Red Hat Enterprise Linux Developer Hub \u003c1.7.3","vendor":{"name":"Red Hat"}}},{"id":"866ad097-3701-37e1-a820-1cb5b954d461","product":{"name":"Red Hat Enterprise Linux Developer Hub 1.7.3","vendor":{"name":"Red Hat"}}},{"id":"a11531fe-ce05-3aa9-ba81-a7147da461fd","product":{"name":"Red Hat Enterprise Linux","vendor":{"name":"Red Hat"}}},{"id":"b7d48ddf-8f5e-35af-9ecc-a7176d3fa3d8","product":{"name":"Developer Hub 1.7.3","vendor":{"name":"Red Hat"}}},{"id":"da08e2c2-6dcd-33d3-8ca9-8d4b8035b4f6","product":{"name":"Enterprise Linux","vendor":{"name":"Red Hat"}}}]}},{"id":"34e23785-aa9b-3483-98b9-1f0efd260bf4","advisory":{"id":"RHSA-2025:22861","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.1 release.","summary":"Red Hat Developer Hub 1.8.1 has been released.","datePublished":"Dec 8, 2025, 3:17:40 PM","dateUpdated":"Oct 15, 2026, 7:22:05 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2025:22861\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22861.json\n","aliases":"CVE-2025-60542\nCVE-2025-66031\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"1d1e7845-d422-3d91-b9ca-0b9ee6e88d5a","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:27d08ffa1bc6a2270b5eab59aedaf866cf68ccb902503c2e58e2e2337a1236b9_amd64","vendor":{"name":"Red Hat"}}},{"id":"2f91bce3-8d29-3706-b77b-b5d4c70009c5","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:43839417363ec2910a4746050005f9fbe5efe5776d44a0bd36a8f4b8ecf71ffa_amd64","vendor":{"name":"Red Hat"}}},{"id":"779f5aab-10d8-3677-b8ad-32db15ee1b01","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:8b5ec4b6085ecb32ea52c33d97adecc313341681b41d891f5346e9b9f8b8a249_amd64","vendor":{"name":"Red Hat"}}},{"id":"c98aeb2c-6dfd-38f5-b7ec-6176f4d1f63b","product":{"name":"Red Hat Developer Hub 1.8","vendor":{"name":"Red Hat"}}}]}},{"id":"75d982f9-7c27-330f-a66b-a9c0c07996d1","advisory":{"id":"RHSA-2025:22404","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.7.3 release.","summary":"Red Hat Developer Hub 1.7.3 has been released.","datePublished":"Dec 1, 2025, 9:19:00 AM","dateUpdated":"Sep 8, 2026, 12:40:12 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2025:22404\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22404.json\n","aliases":"CVE-2025-60542\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"2e43d0e8-f69c-3304-945a-691f5db02d16","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f45ee5600c84c3d014c8bfb9a06e3b600acaa74ce8ff4bf12e5124d25cbe5bfe_amd64","vendor":{"name":"Red Hat"}}},{"id":"32b5a3f5-24ce-3d9e-8461-78031339147b","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bedacfa68d74fce1e9efe3a3fdb18963f4e648d7ab6ccf34b868d62d9f25304a_amd64","vendor":{"name":"Red Hat"}}},{"id":"a6ff83a1-8bf7-3d40-9f3e-9e2e87b6227a","product":{"name":"Red Hat Developer Hub 1.7","vendor":{"name":"Red Hat"}}},{"id":"b29a9503-eaaf-389b-9414-dce4f7981076","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:54c5cd2a4865a372ba9465908f73928382745e04ad446c97b28adde213d13309_amd64","vendor":{"name":"Red Hat"}}}]}}]}