What’s Vulnerable › Vulnerabilities

CVE-2026-73651: TypeORM: migration:generate template-literal code injection

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-09-18
• Weakness: CWE-94

Description

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.

Affected products

• typeorm: before 0.3.31; from 1.0.0, < 1.1.0

References

• https://github.com/typeorm/typeorm/commit/41d1c62fe49f99c3ca916d4d986f61ee9f45d519
• https://github.com/typeorm/typeorm/commit/b175f9b8be422edd2a2ac035ba90c3f2ce782dfe
• https://github.com/typeorm/typeorm/releases/tag/0.3.31
• https://github.com/typeorm/typeorm/releases/tag/1.1.0
• https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49

Get alerted when CVE-2026-73651 or the next vulnerability affects your stack