CVE-2026-73651: TypeORM: migration:generate template-literal code injection
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
typeormto a version that resolves this vulnerability.Fixed in 0.3.31 - Upgrade
Upgrade
typeormto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73651?
The severity of CVE-2026-73651 is rated as medium with a score of 5.7.
What does CVE-2026-73651 affect?
CVE-2026-73651 affects TypeORM versions prior to 0.3.31 and 1.1.0.
What type of vulnerability is CVE-2026-73651?
CVE-2026-73651 is a code injection vulnerability specifically related to template literals.
How do I fix CVE-2026-73651?
To fix CVE-2026-73651, upgrade TypeORM to version 0.3.31 or 1.1.0 or later.
What impact does CVE-2026-73651 have?
CVE-2026-73651 can lead to potential code injection and SQL injection vulnerabilities due to improper handling of database schema metadata.