CVE-2025-32020
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser
The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. This vulnerability is fixed in 0.1.0.
Reserved 2025-04-01 | Published 2025-04-08 | Updated 2025-04-08 | Assigner GitHub_MCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
github.com/...parser/security/advisories/GHSA-9r25-rp3p-h2w4
Support options
