TypeORM code injection in migration:generate template literals

Executive brief

TypeORM is a popular tool used by developers to manage database schemas and migrations. A vulnerability in its migration generation command allows an attacker with database access to inject malicious code into generated migration files. When a developer or automated system runs these migrations, the malicious code executes on their machine, potentially leading to a full system compromise or data theft.

Technical details

The `migration:generate` command in TypeORM fails to sanitize database metadata (such as column comments, default values, and view definitions) when embedding them into JavaScript/TypeScript template literals. While backticks are escaped, the `${...}` interpolation sequence is left intact. An attacker with DDL/write access to the database can inject a payload into schema metadata. When a developer or CI/CD pipeline runs `migration:generate`, the payload is written into the resulting migration file. Arbitrary code execution occurs when the migration file is subsequently loaded via `import`, `require`, or `migration:run`. The vulnerability affects multiple drivers including Postgres, MySQL, MariaDB, and CockroachDB. It is fixed in versions 0.3.31 and 1.1.0.

Affected products

• typeorm typeorm < 0.3.31, >= 1.0.0 < 1.1.0

Timeline

• 2026-07-13: disclosed
• 2026-07-21: advisory

References

• https://api.github.com/users/smith-xyz
• https://github.com/smith-xyz
• https://api.github.com/users/smith-xyz/gists%7B/gist_id%7D
• https://api.github.com/users/smith-xyz/repos
• https://avatars.githubusercontent.com/u/51304449?v=4
• https://api.github.com/users/smith-xyz/events%7B/privacy%7D