typeorm CVE-2022-33171 findOne(id), findOneOrFail(id) The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. The issue was already fixed from version 0.3.0 onward when we encountered it. Maintainer does not consider this a vulnerability and stated the root cause is bad input validation.
