{
  "schema_version": "1.4.0",
  "id": "GHSA-9r25-rp3p-h2w4",
  "modified": "2025-04-09T12:57:13Z",
  "published": "2025-04-09T12:57:13Z",
  "aliases": [
    "CVE-2025-32020"
  ],
  "summary": "crud-query-parser SQL Injection vulnerability",
  "details": "### Impact\n\nImproper neutralization of the `order`/`sort` parameter in the TypeORM adapter, which allows SQL injection.\n\nYou are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.\n\nVersions 0.0.1, 0.0.2 and 0.0.3 are affected by this vulnerability.\n\n### Patches\n\nThis vulnerability has been fixed in version 0.1.0 and newer, which introduces TypeORM field validation (enabled by default).\n\n### Workarounds\n\n#### Add an allowlist of fields\nList all valid fields and use the `filterProperties` function to filter out invalid fields before passing the crudRequest to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest = filterProperties(crudRequest, ['id', 'title', 'category.name']);\n```\n\n#### Disable ordering\nCleanup the `order` field just before passing it to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest.order = [];\n```",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "crud-query-parser"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Guichaguri/crud-query-parser/security/advisories/GHSA-9r25-rp3p-h2w4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32020"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Guichaguri/crud-query-parser"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-09T12:57:13Z",
    "nvd_published_at": "2025-04-08T15:15:50Z"
  }
}