CVE-2025-60542 is a critical SQL Injection vulnerability discovered in the TypeORM library, a popular Object-Relational Mapping (ORM) tool used in Node.js applications to interact with databases. The vulnerability exists in versions prior to 0.3.26 and is triggered when an attacker sends a specially crafted request to the repository.save or repository.update methods. The root cause is linked to the sqlstring library's stringifyObjects option, which defaults to false, leading to improper sanitization of input objects. This improper handling allows malicious SQL code injection, enabling attackers to manipulate database queries. Such injection can lead to unauthorized data access, data modification, or even deletion, severely impacting application integrity and availability. No CVSS score has been assigned yet, and no public exploits have been reported, but the vulnerability is publicly disclosed and considered exploitable. The lack of authentication or user interaction requirements increases the risk, especially for exposed APIs using vulnerable TypeORM versions. This vulnerability highlights the importance of secure input validation and timely patching in ORM libraries.

For European organizations, the impact of CVE-2025-60542 can be significant, especially for those relying on TypeORM in their backend infrastructure. Exploitation could lead to unauthorized access to sensitive customer data, intellectual property, or internal business information, resulting in data breaches and regulatory non-compliance, particularly under GDPR. The integrity of data could be compromised, leading to corrupted records or fraudulent transactions. Availability of services could also be affected if attackers execute destructive SQL commands or cause database outages. Organizations in sectors such as finance, healthcare, e-commerce, and government are particularly at risk due to the sensitivity of their data and the critical nature of their services. The absence of known exploits currently provides a window for proactive mitigation, but the ease of exploitation via crafted requests means attackers could develop exploits rapidly once the vulnerability is known.

To mitigate CVE-2025-60542, organizations should immediately upgrade TypeORM to version 0.3.26 or later, where the vulnerability has been addressed. Review and audit all database interaction code that uses repository.save and repository.update methods to ensure no unsafe input handling remains. Implement strict input validation and sanitization on all user-supplied data before it reaches ORM methods. Employ Web Application Firewalls (WAFs) with SQL Injection detection rules to provide an additional layer of defense. Monitor application logs for unusual database query patterns or errors indicative of injection attempts. Conduct regular security testing, including dynamic application security testing (DAST) and code reviews focused on injection vulnerabilities. Finally, ensure that database accounts used by applications have the least privileges necessary to limit the impact of any successful injection.