GitHub Advisoryadvisory · npm

GHSA-pf2j-9qmp-jqr2 TypeORM vulnerable to MAID and Prototype Pollution

CRITICAL Published 2021-05-07 Modified 2022-08-11 Official page ↗
Aliases
CVE-2020-8158
Ecosystem
npm
Packages
typeorm
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-471
Reviewed
2021-04-28

Affected packages

• npm typeorm: < 0.2.25 → fixed in 0.2.25

Description

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

Related

Alias · CVE (1)

  • CVE-2020-8158 Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References