TypeORM CVE-2025-60542

Requires an application built on TypeORM (before 0.3.26) using the MySQL driver that passes attacker-influenced object values into repository.save or repository.update; the root cause is the sqlstring call relying on the default stringifyObjects: false, which allows a nested object to be serialized into the SQL statement rather than safely escaped. Limiting factors: the vulnerable code path is MySQL-driver specific (the fix only modifies MysqlDriver.ts), and exploitation depends on the application routing untrusted structured input (an object, not a plain scalar) into those persistence methods - applications that only pass scalar values or sanitize input are not exposed. Impact is bounded (CVSS C:L/I:L/A:N), indicating partial data read/modify rather than full database compromise.

This is a moderate, largely conditional risk rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) reads as remotely reachable with low complexity and no privileges, but that scoring reflects the library in the abstract: the actual flaw (per the PR diff touching src/driver/mysql/MysqlDriver.ts and setting stringifyObjects: true) only manifests when an application passes attacker-controlled object values into repository.save or repository.update using the MySQL driver, so real exposure is application- and driver-dependent. The supporting signals point to lower urgency: EPSS is 0.27% (18th percentile), there is no CISA KEV listing (not actively exploited per available data), and the vuln.today Decision label is this_month rather than act_now/emergency. The confidentiality/integrity impact is rated Low and availability None, consistent with constrained SQL injection rather than full database takeover. These signals are mutually consistent - a genuine, patchable injection defect with limited real-world exploitation pressure - so this should be scheduled for prompt patching in normal maintenance, not treated as a critical incident. Note the PR:N in the vector describes the library having no built-in auth gate; whether a given deployment is truly unauthenticated depends on the surrounding application.

A Node.js application uses TypeORM with the MySQL driver and persists a request-supplied object (for example a filter or entity payload) via repository.save or repository.update. Because sqlstring is invoked with stringifyObjects defaulting to false, a nested object in that input is serialized in a way that breaks out of the intended parameterization, letting the attacker alter the SQL statement and read or modify unintended rows. A Medium write-up documenting the issue exists, but the input does not confirm packaged, working exploit code.