{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/typeorm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-76848"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TypeORM"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TypeORM"],"content_html":"\u003cp\u003eTypeORM is susceptible to SQL injection (CVE-2026-76848) within its SelectQueryBuilder.distinctOn method when utilizing PostgreSQL-family database drivers. The underlying vulnerability exists in src/query-builder/SelectQueryBuilder.ts, where the createSelectDistinctExpression function joins and interpolates user-provided array elements directly into a SQL statement. Unlike other methods in the query builder that utilize identifier validation or driver-specific escaping, distinctOn bypasses these security controls, including the allowlist checks used by orderBy.\u003c/p\u003e\n\u003cp\u003eWhen an application allows client-controlled data to be passed into distinctOn, an attacker can supply arbitrary SQL fragments, including correlated subqueries. This provides a mechanism for attackers to perform blind SQL injection, exfiltrating data the application's database role can access through boolean or time-based inference. Because this occurs within a parenthesized SQL expression list, the impact is significant for any Node.js application relying on TypeORM for database interactions that dynamically handles query parameters from user inputs.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized access to data stored in the database, potentially leading to full information disclosure if the application database role has sufficient permissions. An attacker can use this flaw to exfiltrate data from any reachable table by observing the timing or boolean responses of the application. This affects any application using TypeORM that dynamically generates distinct-on clauses based on untrusted user input.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all occurrences of SelectQueryBuilder.distinctOn in the codebase to identify instances where user-controlled input is passed directly to the function.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or mapping to a static allowlist of column names before passing values to distinctOn.\u003c/li\u003e\n\u003cli\u003eUpgrade TypeORM to a patched version once released by the maintainers that ensures input sanitization or proper escaping within the distinctOn method.\u003c/li\u003e\n\u003cli\u003eReview database role permissions to ensure the application follows the principle of least privilege, minimizing the blast radius of a successful SQL injection attack.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T18:03:44Z","date_published":"2026-08-24T18:03:44Z","id":"https://feed.craftedsignal.io/briefs/2026-08-typeorm-sql-injection/","summary":"TypeORM is vulnerable to SQL injection via the SelectQueryBuilder.distinctOn method due to improper input validation and escaping, allowing for unauthorized data exfiltration through injected subqueries.","title":"TypeORM SelectQueryBuilder SQL Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-08-typeorm-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - TypeORM","version":"https://jsonfeed.org/version/1.1"}