Most recent entries from all

EUVD-2026-352836

2026-10-08T01:58:39.159916+00:00

EUVD-2026-352836

fkie_cve-2026-73651

2026-10-08T01:58:39.159955+00:00

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.

GHSA-2rp8-mm9q-fp49 — TypeORM: migration:generate template-literal code injection

2026-10-08T01:58:39.159991+00:00

Affected: npm: typeorm

### Summary

`typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backticks but not `${...}`. An attacker who can write schema metadata (column comments, defaults, view definitions) achieves arbitrary code execution on the host that loads the generated migration.

### Details

`MigrationGenerateCommand.ts` (L117-138) wraps each SQL statement in a JS template literal, escaping only backticks:

```typescript " await queryRunner.query(`" + upQuery.query.replaceAll("`", "\\`") + "`" + ... ```

Introspected schema strings reach this sink through driver query runners:

| Driver | Metadata source | Source | |---|---|---| | Postgres | column `DEFAULT`, `COMMENT`, `CHECK` constraints, view definitions | [`PostgresQueryRunner.ts:1782`](https://github.com/typeorm/typeorm/blob/bf47c9f/src/driver/postgres/PostgresQueryRunner.ts#L1782), [`L1898`](https://github.com/typeorm/typeorm/blob/bf47c9f/src/driver/postgres/PostgresQueryRunner.ts#L1898), [`L2287`](https://github.com/typeorm/typeorm/blob/bf47c9f/src/driver/postgres/PostgresQueryRunner.ts#L2287), [`L4125`](https://github.com/typeorm/typeorm/blob/bf47c9f/src/driver/postgres/PostgresQueryRunner.ts#L4125) | | MySQL/MariaDB | `COLUMN_DEFAULT`, `COLUMN_COMMENT` | [`MysqlQueryRunner.ts:2873-2974`](https://github.com/typeorm/typeorm/blob/bf47c9f/src/driver/mysql/MysqlQueryRunner.ts#L2873-L2974), [`L3580-3583`](https://github.com/typeorm/typeorm/blob/bf47c9f/src/driver/mysql/MysqlQ…