CVE-2026-73651

Name of the Vulnerable Software and Affected Versions TypeORM versions prior to 0.3.31 TypeORM versions prior to 1.1.0

Description TypeORM embeds database schema metadata into JavaScript or TypeScript template literals within the MigrationGenerateCommand.ts file. While backticks are escaped, the ${...} interpolation is not. An attacker with write access to the database schema can inject a payload into the column COMMENT or DEFAULT metadata, or other introspected schema strings. The JavaScript engine then evaluates this payload when the generated migration is loaded via migration:run, import, or require.

Recommendations Update TypeORM to version 0.3.31 or later. Update TypeORM to version 1.1.0 or later.