Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM
Date: 2026-01
Affected: npm/@veramo/data-store
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-89
CVSS: 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)

## Summary An SQL injection vulnerability exists in the `@veramo/data-store` package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is caused by insufficient validation of the `column` parameter in the `order` array of query requests. ## Details `packages/data-store/src/data-store-orm.ts` (lines 416-434) The vulnerability exists in the `decorateQB()` function which processes query ordering parameters: ```typescript function decorateQB( qb: SelectQueryBuilder<any>, tableName: string, input: FindArgs<any>, ): SelectQueryBuilder<any> { if (input?.skip) qb = qb.offset(input.skip) if (input?.take) qb = qb.limit(input.take) if (input?.order) { for (const item of input.order) { qb = qb.addSelect( qb.connection.driver.escape(tableName) + '.' + qb.connection.driver.escape(item.column), item.column, ) qb = qb.orderBy(qb.connection.driver.escape(item.column), item.direction) } } return qb } ``` **Root Cause:** 1. The `item.column` value from user input is passed directly as the **alias** parameter to `addSelect()` without any sanitization or validation 2. While TypeScript defines allowed column types (e.g., `TCredentialColumns = 'context' | 'type' | ...`), this is only compile-time checking 3. At runtime, the function accepts `FindArgs<any>`, allowing arbitrary strings to bypass type restrictions 4. TypeORM inserts the alias directly into the SQL query, enabling


Mitigations:

Architectural layers (MAESTRO):