veramo @veramo/data-store vulnerabilities

Latest veramo @veramo/data-store CVEs

Newest publication first

1. GHSA-38cw-85xc-xr9x Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM

   Published 2026-01-16

   Medium·CVSS 6.8

   Summary An SQL injection vulnerability exists in the @veramo/data-store package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is caused by insufficient validation of the column parameter in the order array of query req...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.