Junglewise Threat Intelligence

CVE-2026-73651: TypeORM migration:generate template-literal code injection

CVE-2026-73651 · Severity: low · CVSS 3.1 · Published 2026-07-21

Technologies: Typeorm.

Executive brief

TypeORM's migration:generate command automatically creates database migration files from a live database schema. When generating these files, the tool embeds database metadata (such as column comments and defaults) directly into JavaScript template literals without properly escaping template interpolation syntax. An attacker who can modify database schema metadata (via direct database access or application features) can inject arbitrary JavaScript code that executes whenever a developer or CI/CD pipeline generates or runs migrations, leading to remote code execution on the developer's machine.

Technical details

The vulnerability exists in MigrationGenerateCommand.ts (lines 117-138), which constructs JavaScript template literals by concatenating SQL statements with only backtick escaping: `await queryRunner.query(\`${sql}\`)`. The escapeComment() methods in PostgresDriver, MysqlDriver, and CockroachDriver strip only null bytes, leaving ${...} expressions intact. When database metadata from information_schema (PostgreSQL COMMENT/DEFAULT, MySQL COLUMN_COMMENT/COLUMN_DEFAULT, CockroachDB equivalents) reaches the template literal sink, untrusted ${...} patterns are evaluated as live JavaScript interpolations. This occurs in both up() and down() migration methods. Exploitation requires the attacker to have DDL/write access to the target database or influence over user-settable schema metadata. When the developer runs `migration:generate` or when CI/CD loads the generated migration file, the injected JavaScript executes with the privileges of the Node.js process. The fix involves escaping ${...} to \${...} and \\ to \\\\ before embedding query strings into template literals, or switching to JSON.stringify()-encoded string arguments. Patches are available in versions 0.3.31 and 1.1.0.

Affected products

  • TypeORM typeorm < 0.3.31, >= 1.0.0 and < 1.1.0

Timeline

  • 2026-07-21: disclosed: GHSA-2rp8-mm9q-fp49 published; CVE-2026-73651 assigned
  • 2026-07-13: patched: Fix merged via commits 41d1c62 and b175f9b; versions 0.3.31 and 1.1.0 released

References