CVE-2026-73651
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
TypeORM prior to versions 0.3.31 and 1.1.0 contains a vulnerability in the migration:generate command that embeds database schema metadata into JavaScript or TypeScript template literals, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded.
Risk Assessment
An attacker could execute arbitrary JavaScript in the context of the Node.js process, potentially leading to full compromise of the application or system.
Recommendation
Update TypeORM to version 0.3.31 or 1.1.0 and restrict database schema write access to trusted users only.
Original NVD description (English source)
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.