CVE-2025-60542

—

CVSS 3.1

6.5 medium

EPSS

<1%p16

Published

Oct 29, 2025 (Oct 29, 2025)

Modified

Jun 17, 2026

Description

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.