CVE-2026-73651

What it actually does

TypeORM's migration:generate command writes unsanitized database schema metadata (such as column COMMENT or DEFAULT values) into JavaScript/TypeScript template literals without escaping ${...} interpolation, allowing arbitrary code execution when the generated migration file is later imported or required.

Why it matters to the business

Attackers who can modify database schema metadata can cause code execution on developer or CI systems that generate and run migrations, potentially leading to supply-chain compromise or unauthorized access to source repositories and build environments.

How an attack unfolds

An attacker with write access to database schema metadata inserts a malicious ${...} expression into a column COMMENT or DEFAULT value. When a developer runs typeorm migration:generate, the payload is embedded into the generated migration file. Later execution of that file via migration:run, import, or require causes the JavaScript engine to evaluate the payload.

How to fix it

Upgrade TypeORM to version 0.3.31 or 1.1.0 (or later) in all Node.js projects. Regenerate any existing migration files created with vulnerable versions after the upgrade. Avoid running migration:generate against untrusted database schemas.

How to confirm the fix worked

Confirm that typeorm package.json version is at least 0.3.31 or 1.1.0. Re-run migration:generate against a test schema containing a column with a ${...} string in its COMMENT and verify the generated file contains an escaped or removed interpolation sequence rather than executable code.

Typical attack path

1. Attacker obtains database schema write access
2. Attacker places payload inside column COMMENT, DEFAULT, or similar introspected metadata
3. Developer or CI pipeline executes typeorm migration:generate against the compromised schema
4. Generated migration file containing the unescaped payload is written to disk
5. Migration file is loaded via migration:run, import, or require, triggering code execution

How to detect it

Search source repositories and build logs for migration files containing unescaped ${...} sequences in string literals that do not originate from legitimate template usage. Monitor for unexpected code execution or network activity immediately after running typeorm migration:generate or migration:run against external schemas.

What your security team should do

• Immediately upgrade all TypeORM installations to 0.3.31 or 1.1.0
• Audit source control history for migration files generated before the upgrade that contain unescaped template literals
• Restrict database schema modification privileges to trusted principals only
• Add pre-commit or CI checks that scan generated migration files for ${...} patterns outside of legitimate template usage