-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typeorm | npm | < 0.3.0 | 0.3.0 |
Miggo AIRoot Cause AnalysisThe CVE description explicitly identifies findOne as the vulnerable function due to its ability to accept either string IDs or FindOneOptions objects. The vulnerability manifests when untrusted input is passed as a parsed JSON object, allowing attackers to inject SQL via crafted options. While exact file paths aren't explicitly stated in provided sources, TypeORM's architecture places repository methods like findOne in repository/Repository.ts. The high confidence comes from multiple independent sources (CVE, GHSA, disclosure examples) explicitly referencing this function's behavior as the attack vector.