CVE-2026-73651: TypeORM migration:generate template-literal code injection

CVE-2026-73651 · Severity: low · CVSS 3.1 · Published 2026-07-21

TypeORM's migration:generate command automatically creates database migration files from a live database schema. When generating these files, the tool embeds database metadata (such as column comments and defaults) directly into JavaScript template literals without properly escaping template interpolation syntax. An attacker who can modify database schema metadata (via direct database access or application features) can inject arbitrary JavaScript code that executes whenever a developer or CI/CD pipeline generates or runs migrations, leading to remote code execution on the developer's machine.

Technologies: typeorm (npm). Vendors: npm.

Quick answers

Is CVE-2026-73651 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73651 being exploited in the wild.
How severe is CVE-2026-73651?
Low severity, with a CVSS score of 3.1, published 21 July 2026.
Which products and versions are affected?
typeorm (npm) SEMVER:introduced=0,fixed=0.3.31.
Is there a fix for CVE-2026-73651?
Yes. typeorm (npm): upgrade to 0.3.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73651 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-73651?
Check whether you run typeorm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • typeorm (npm): upgrade to 0.3.31 or later
    npm install typeorm@0.3.31

Technical details

The vulnerability exists in MigrationGenerateCommand.ts (lines 117-138), which constructs JavaScript template literals by concatenating SQL statements with only backtick escaping: `await queryRunner.query(\`${sql}\`)`. The escapeComment() methods in PostgresDriver, MysqlDriver, and CockroachDriver strip only null bytes, leaving ${...} expressions intact. When database metadata from information_schema (PostgreSQL COMMENT/DEFAULT, MySQL COLUMN_COMMENT/COLUMN_DEFAULT, CockroachDB equivalents) reaches the template literal sink, untrusted ${...} patterns are evaluated as live JavaScript interpolations. This occurs in both up() and down() migration methods. Exploitation requires the attacker to have DDL/write access to the target database or influence over user-settable schema metadata. When the developer runs `migration:generate` or when CI/CD loads the generated migration file, the injected JavaScript executes with the privileges of the Node.js process. The fix involves escaping ${...} to \${...} and \\ to \\\\ before embedding query strings into template literals, or switching to JSON.stringify()-encoded string arguments. Patches are available in versions 0.3.31 and 1.1.0.

Affected products

  • TypeORM typeorm < 0.3.31, >= 1.0.0 and < 1.1.0

Identifiers

  • CVE-2026-73651
  • GHSA-2rp8-mm9q-fp49

Timeline

  • 2026-07-21: disclosed: GHSA-2rp8-mm9q-fp49 published; CVE-2026-73651 assigned
  • 2026-07-13: patched: Fix merged via commits 41d1c62 and b175f9b; versions 0.3.31 and 1.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.