Add CVSS 3.1 score for GHSA-w7q7-vjp8-7jv4 (typeorm SQL Injection)

[sunnypatell]

Changes

Added missing CVSS scoring to GHSA-w7q7-vjp8-7jv4 (SQL Injection in typeorm).

Added:

• CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical)
• PACKAGE reference to the typeorm repo

Reason for change

This advisory had no CVSS score at all. The vulnerability allows unauthenticated attackers to inject arbitrary SQL through unvalidated field names passed to typeorm's find() API, so the score should reflect full network-accessible SQL injection with no auth required.

CVSS justification

• PR:N/UI:N because typeorm is used in web apps where user input reaches query methods without requiring authentication at the ORM layer
• C:H/I:H/A:H because SQL injection gives full read/write/delete access to the database

The scoring is consistent with the related typeorm SQL injection CVE-2022-33171, which NVD scored identically at 9.8.

Supporting links

• Fix commit: typeorm/typeorm@d46c8b0
• HackerOne report: https://hackerone.com/reports/319458
• npm advisory: https://www.npmjs.com/advisories/800
• Related vuln for reference: https://nvd.nist.gov/vuln/detail/CVE-2022-33171

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.