CVE-2026-73651 in TypeORM
Summary
by MITRE • 08/13/2026
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
TypeORM represents a significant vulnerability in its migration generation functionality that stems from inadequate input sanitization of database schema metadata. The flaw exists specifically within the MigrationGenerateCommand.ts file where the system embeds database schema information into JavaScript template literals without properly escaping all potentially dangerous interpolation sequences. While backticks are appropriately escaped, the ${...} interpolation syntax remains unescaped, creating a critical security gap that allows for arbitrary code execution when migrations are subsequently processed.
The technical implementation of this vulnerability relies on the fact that TypeORM's migration generation process directly incorporates introspected database schema elements into generated code templates. When database schema metadata contains specially crafted payloads within COMMENT or DEFAULT field definitions, these strings are embedded verbatim into JavaScript source code without proper sanitization. This creates a classic server-side template injection vulnerability where attacker-controlled data flows into executable code contexts.
The operational impact of this vulnerability extends beyond simple code execution to encompass full system compromise when attackers gain write access to database schemas. An attacker with schema modification privileges can inject malicious payloads that execute during migration processing, potentially leading to data exfiltration, privilege escalation, or complete system takeover. The vulnerability affects both JavaScript and TypeScript environments where TypeORM is deployed, making it particularly dangerous in production systems.
This security issue maps directly to CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" and aligns with ATT&CK technique T1059.006 for "Command and Scripting Interpreter: JavaScript". The vulnerability demonstrates how database schema introspection can become a vector for code injection attacks when proper sanitization practices are not implemented in ORM tooling. Organizations using TypeORM versions prior to 0.3.31 or 1.1.0 should immediately assess their migration processes and implement compensating controls while upgrading to patched versions.
The fix implemented in versions 0.3.31 and 1.1.0 addresses the core sanitization issue by ensuring all potentially dangerous interpolation sequences are properly escaped during migration generation. This remediation follows established security best practices for preventing code injection vulnerabilities and aligns with industry standards for secure coding practices in database interaction frameworks. Security teams should verify that their TypeORM deployments have been upgraded to these patched versions and conduct thorough testing of migration processes to ensure the fix has been properly implemented across all environments.