GHSA-q2pj-6v73-8rgj
Medium · 6.5CVSS
6.5
EPSS
—
Published
Oct 29, 2025
CISA due date
—
The record
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | typeorm | 0 | 0.3.26 |
| Chainguard | redisinsight | 0 | 2.70.1-r3 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 2.70.1-r3 |
Related vulnerabilities
- CVE-2025-60542 SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to… Same vulnerability
- GHSA-9ggv-8w38-r7pm TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy… Also affects typeorm
- GHSA-27v5-c462-wpq7 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards Also affects redisinsight
- GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups Also affects redisinsight
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects redisinsight
- CVE-2026-33532 `yaml` is a YAML parser and serialiser for JavaScript. Also affects redisinsight
- CVE-2026-4923 Impact: When using multiple wildcards, combined with at least one parameter, a regular… Also affects redisinsight
- CVE-2026-4926 Impact: A bad regular expression is generated any time you have multiple sequential… Also affects redisinsight