CVE-2025-32020
CVE-2025-32020 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. This vulnerability is fixed in 0.1.0.
CVSS 9.3 · Critical · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
crud-query-parser
- Versions
- < 0.1.0: Affected
No fix published
crud-query-parser npm
- Affected ranges
- SEMVER: < 0.1.0
Update to 0.1.0