typeorm vulnerabilities and fixes

Q: How do I fix typeorm vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is typeorm being exploited right now?

None of the tracked typeorm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which typeorm CVE should I patch first?

CVE-2022-33171 currently ranks highest (69/100): The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object.

Recent CVEs affecting typeorm, with upgrade or downgrade steps. 2 tracked.

typeorm has 2 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2022-07-04. Highest priority: CVE-2022-33171 (score 69/100).

CVE-2022-33171 CRITICAL 9.8 UPGRADE The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object
CVE-2020-8158 CRITICAL 9.8 UPGRADE Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object

FAQ

How do I fix typeorm vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is typeorm being exploited right now?

None of the tracked typeorm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which typeorm CVE should I patch first?

CVE-2022-33171 currently ranks highest (69/100): The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object.

← Back to latest CVEs