Paper/Archive/CVE-2025-32020

CVE-2025-32020

Guichaguri crud-query-parser — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser

EPSS 0.4%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 30.3.303 × 206.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. This vulnerability is fixed in 0.1.0.

Affected

ProductAffectedFixed inSource

crud-query-parser< 0.1.0–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/Guichaguri/crud-query-parser/security/advisories/GHSA-9r25-rp3p-h2w4