{"id":"GHSA-9r25-rp3p-h2w4","summary":"crud-query-parser SQL Injection vulnerability","details":"### Impact\n\nImproper neutralization of the `order`/`sort` parameter in the TypeORM adapter, which allows SQL injection.\n\nYou are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.\n\nVersions 0.0.1, 0.0.2 and 0.0.3 are affected by this vulnerability.\n\n### Patches\n\nThis vulnerability has been fixed in version 0.1.0 and newer, which introduces TypeORM field validation (enabled by default).\n\n### Workarounds\n\n#### Add an allowlist of fields\nList all valid fields and use the `filterProperties` function to filter out invalid fields before passing the crudRequest to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest = filterProperties(crudRequest, ['id', 'title', 'category.name']);\n```\n\n#### Disable ordering\nCleanup the `order` field just before passing it to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest.order = [];\n```","aliases":["CVE-2025-32020"],"modified":"2025-04-09T13:42:21.679410Z","published":"2025-04-09T12:57:13Z","database_specific":{"github_reviewed_at":"2025-04-09T12:57:13Z","nvd_published_at":"2025-04-08T15:15:50Z","cwe_ids":["CWE-89"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/Guichaguri/crud-query-parser/security/advisories/GHSA-9r25-rp3p-h2w4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32020"},{"type":"PACKAGE","url":"https://github.com/Guichaguri/crud-query-parser"}],"affected":[{"package":{"name":"crud-query-parser","ecosystem":"npm","purl":"pkg:npm/crud-query-parser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-9r25-rp3p-h2w4/GHSA-9r25-rp3p-h2w4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}