{"id":"CVE-2025-32020","aliases":["EUVD-2025-10403","GHSA-9r25-rp3p-h2w4"],"status":"published","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser","description":"The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.  This vulnerability is fixed in 0.1.0.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00372,"percentile":0.31417,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2025-04-08T15:05:26Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"npm","package":"crud-query-parser","fixed_in":["0.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"crud-query-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"crud-query-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.0"}]}]}],"products":[{"vendor":"guichaguri","product":"crud-query-parser"}],"references":[{"url":"https://github.com/Guichaguri/crud-query-parser/security/advisories/GHSA-9r25-rp3p-h2w4","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32020","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9r25-rp3p-h2w4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32020.json","tags":["advisory"]},{"url":"https://github.com/Guichaguri/crud-query-parser","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-32020","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser","description":"The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.  This vulnerability is fixed in 0.1.0.","status":"published","published":"2025-04-08T15:05:26.333Z","modified":"2025-04-08T15:39:55.126Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:46.42892Z"}],"euvd":[{"id":"EUVD-2025-10403","description":"The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.  This vulnerability is fixed in 0.1.0.","status":"published","published":"2025-04-08T15:05:26Z","modified":"2025-04-08T15:39:55Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T20:52:40.053562Z"}],"ghsa":[{"id":"GHSA-9r25-rp3p-h2w4","title":"crud-query-parser SQL Injection vulnerability","description":"### Impact\n\nImproper neutralization of the `order`/`sort` parameter in the TypeORM adapter, which allows SQL injection.\n\nYou are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.\n\nVersions 0.0.1, 0.0.2 and 0.0.3 are affected by this vulnerability.\n\n### Patches\n\nThis vulnerability has been fixed in version 0.1.0 and newer, which introduces TypeORM field validation (enabled by default).\n\n### Workarounds\n\n#### Add an allowlist of fields\nList all valid fields and use the `filterProperties` function to filter out invalid fields before passing the crudRequest to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest = filterProperties(crudRequest, ['id', 'title', 'category.name']);\n```\n\n#### Disable ordering\nCleanup the `order` field just before passing it to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest.order = [];\n```","status":"published","published":"2025-04-09T12:57:13Z","modified":"2025-04-09T12:57:14Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:38.344711Z"}],"nvd":[{"id":"CVE-2025-32020","description":"The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.  This vulnerability is fixed in 0.1.0.","status":"published","published":"2025-04-08T15:15:50.43Z","modified":"2026-06-17T09:11:19.967Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:59.48027Z"}],"osv":[{"id":"CVE-2025-32020","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser","description":"The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.  This vulnerability is fixed in 0.1.0.","status":"published","published":"2025-04-08T15:05:26.333Z","modified":"2026-10-28T02:30:44.111293127Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-9r25-rp3p-h2w4","title":"crud-query-parser SQL Injection vulnerability","description":"### Impact\n\nImproper neutralization of the `order`/`sort` parameter in the TypeORM adapter, which allows SQL injection.\n\nYou are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.\n\nVersions 0.0.1, 0.0.2 and 0.0.3 are affected by this vulnerability.\n\n### Patches\n\nThis vulnerability has been fixed in version 0.1.0 and newer, which introduces TypeORM field validation (enabled by default).\n\n### Workarounds\n\n#### Add an allowlist of fields\nList all valid fields and use the `filterProperties` function to filter out invalid fields before passing the crudRequest to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest = filterProperties(crudRequest, ['id', 'title', 'category.name']);\n```\n\n#### Disable ordering\nCleanup the `order` field just before passing it to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest.order = [];\n```","status":"published","published":"2025-04-09T12:57:13Z","modified":"2025-04-09T13:42:21.67941Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}