CVE-2026-73651

MEDIUM 5.7

TypeORM: migration:generate template-literal code injection

CVSS Score

5.7

EPSS Score

0.0%

EPSS Percentile

0th

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.

CWE	CWE-94
Vendor	typeorm
Product	typeorm
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for typeorm typeorm

Be the first to know when new medium vulnerabilities affecting typeorm typeorm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

typeorm / typeorm

< 0.3.31 >= 1.0.0, < 1.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49 github.com: https://github.com/typeorm/typeorm/commit/41d1c62fe49f99c3ca916d4d986f61ee9f45d519 github.com: https://github.com/typeorm/typeorm/commit/b175f9b8be422edd2a2ac035ba90c3f2ce782dfe github.com: https://github.com/typeorm/typeorm/releases/tag/0.3.31 github.com: https://github.com/typeorm/typeorm/releases/tag/1.1.0