Red Hat Developer Hub (RHDH), an enterprise developer portal based on Backstage.io, is affected by a SQL injection vulnerability tracked as CVE-2025-60542. The issue stems from TypeORM's repository.save and repository.update methods incorrectly handling nested JSON objects when using MySQL/mysql2 drivers. The underlying cause is the stringifyObjects option set to false by default, which allows attackers to craft malicious JSON payloads that lead to SQL injection. This can result in bypassing field-level restrictions, unauthorized modification of database columns, and potential privilege escalation. Red Hat Developer Hub versions in the 1.8.0 to before 1.8.1 range are affected. Red Hat has released version 1.8.1 but has not provided a direct fix for the vulnerability within the advisory, recommending updating to the fixed version as the primary mitigation.

Successful exploitation allows attackers to perform SQL injection attacks, leading to unauthorized reading and modification of application data, bypassing access controls, and potentially escalating privileges within the affected Red Hat Developer Hub deployments. This compromises data integrity and confidentiality but does not affect availability. No known exploits in the wild have been reported.

Red Hat advises updating to Red Hat Developer Hub version 1.8.1, which addresses this vulnerability. No practical alternative mitigations have been identified. Users should promptly upgrade affected installations to the fixed version to remediate the issue.