{"id":"GHSA-9ggv-8w38-r7pm","title":"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)","summary":"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)","severity":"medium","cvss":5.9,"cwe":["CWE-89"],"vendor":"typeorm","product":"typeorm","affected":["typeorm >= 0.1.12, <= 0.3.28"],"patched":["typeorm 0.3.29"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9ggv-8w38-r7pm","references":[{"url":"https://github.com/typeorm/typeorm/security/advisories/GHSA-9ggv-8w38-r7pm"},{"url":"https://github.com/typeorm/typeorm/commit/1b66c44d0410bdc56a0dcefb46be41867ec0fffc"},{"url":"https://github.com/typeorm/typeorm/commit/93eec630630b219b162ba4e0c072afa851697cff"},{"url":"https://github.com/advisories/GHSA-9ggv-8w38-r7pm"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-22T15:52:21.074Z","ecosystem":"npm","slug":"GHSA-9ggv-8w38-r7pm","body":"## Overview\n\n### Impact\n\nBlind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users.\n\n`UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `addOrderBy` variants) do not validate the `order` parameter against an allowlist of permitted values (`ASC`/`DESC`). The caller-supplied value is stored verbatim and concatenated directly into the generated SQL string without quoting or parameterization. `SelectQueryBuilder.orderBy` performs this validation correctly; the affected builders do not.\n\nIf any code path passes user-controlled input to `orderBy`/`addOrderBy` on an update or soft-delete query, an attacker can inject arbitrary SQL via the sort direction — even when the column name itself is hardcoded.\n\nDemonstrated impact includes:\n- **Data exfiltration** via time-based blind extraction (e.g. using `SLEEP()` to infer secret values bit by bit)\n- **Row targeting manipulation** in queries using `LIMIT` patterns\n- **Denial of service** via `SLEEP()`-based query exhaustion\n\nCVSS 3.1: **8.6 (High)** — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`\n\nAffected files (relative to commit `73fda419`):\n- `src/query-builder/UpdateQueryBuilder.ts`: lines 383–419 and 718–744\n- `src/query-builder/SoftDeleteQueryBuilder.ts`: lines 352–388 and 520–546\n\nThe vulnerability was introduced in commit `03799bd2` (v0.1.12) and is present through the latest release (v0.3.28).\n\n### Patches\n\nA fix has been released in 0.3.29 (1b66c44) and 1.0.0 (93eec63).\n\n### Workarounds\n\nApplications can manually validate the `order` argument before passing it to `orderBy` or `addOrderBy` on update or soft-delete query builders:\n\n```ts\nconst direction = userInput.toUpperCase();\nif (direction !== 'ASC' && direction !== 'DESC') {\n  throw new Error('Invalid sort direction');\n}\nqb.orderBy(column, direction as 'ASC' | 'DESC');\n```\n\nDo not pass user-controlled values to `orderBy`/`addOrderBy` on `UpdateQueryBuilder` or `SoftDeleteQueryBuilder` without this validation.\n\n### References\n\n- Introduced in commit 03799bd2 (v0.1.12)\n- Confirmed present in v0.3.28 (commit 73fda419)\n- See `SelectQueryBuilder.orderBy` for the correct validation pattern this fix should mirror\n\n## Affected packages\n\n- `typeorm >= 0.1.12, <= 0.3.28`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `typeorm 0.3.29`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}