TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

### Impact Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users. `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not. If any code path passes user-controlled input to `orderBy`/`addOrderBy` on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction — even when the column name itself is hardcoded. Demonstrated impact includes: - **Data exfiltration** via time-based blind extraction (e.g. using `SLEEP()` to infer secret values bit by bit) - **Row targeting manipulation** in queries using `LIMIT` patterns - **Denial of service** via `SLEEP()`-based query exhaustion CVSS 3.1: **8.6 (High)** — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L` Affected files (relative to commit `73fda419`): - `src/query-builder/UpdateQueryBuilder.ts`: lines 383–419 and 718–744 - `src/query-builder/SoftDeleteQueryBuilder.ts`: lines 352–388 and 520–546 The vulnerability was introduced in commit `03799bd2` (v0.1.12) and is present through the latest release (v0.3.28). ### Patches A fix has been released in 0.3.29 (1b66c44) and 1.0.0 (93eec63). ### Workarounds Applications can manually validate the `order` argument before passing it to `orderBy` or `addOrderBy` on update or soft-delete query builders: ```ts const direction = userInput.toUpperCase(); if (direction !== 'ASC' && direction !== 'DESC') { throw new Error('Invalid sort direction'); } qb.orderBy(column, direction as 'ASC' | 'DESC'); ``` Do not pass user-controlled values to `orderBy`/`addOrderBy` on `UpdateQueryBuilder` or `SoftDeleteQueryBuilder` without this validation. ### References - Introduced in commit 03799bd2 (v0.1.12) - Confirmed present in v0.3.28 (commit 73fda419) - See `SelectQueryBuilder.orderBy` for the correct validation pattern this fix should mirror

Source published

19 Jun 2026 19:18:49 UTC

Source modified

10 Sep 2026 03:50:49 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Publisher rating · MODERATE