TypeORM vulnerable to MAID and Prototype Pollution

CRITICAL 9.8CVE-2020-8158 · GHSA-pf2j-9qmp-jqr2 · Published 18/09/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
typeorm typeorm	`< 0.2.25`	`0.2.25`
typeorm npm	`< 0.2.25`	`0.2.25`

Description

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

NVD description

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

References

nvd.nist.gov/vuln/detail/CVE-2020-8158 · ADVISORY
hackerone.com/reports/869574 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free