TypeORM Mass Assignment Vulnerability
Description
Directly assigning req.body to entities allows attackers to modify protected fields like role, isAdmin, or credits.
What Shoulder detects
How to fix
Use explicit field assignment instead of spreading request data.
```typescript
const user = repository.create({
username: req.body.username,
email: req.body.email
// role and isAdmin not assigned from user input
});
```
Learn more: https://shoulder.dev/learn/typescript/cwe-915/mass-assignment
Applies to
Languages
Frameworks
typeorm
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=typeorm-mass-assignment .