Description

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-13T19:17:38.617Z",
  "pubdate": "2026-08-13T19:17:38.617Z",
  "executiveSummary": "An arbitrary code execution vulnerability exists in TypeORM prior to versions 0.3.31 and 1.1.0, specifically within the migration generation command utility.\nThe flaw allows attackers with database schema write access to inject malicious payloads into database metadata strings such as column comments or default values.\nWhen a developer executes the migration:generate command, TypeORM introspects the schema and embeds the untrusted metadata directly into JavaScript or TypeScript template literals without properly neutralizing JavaScript template expression syntax.\nSubsequent execution, importation, or requiring of the generated migration file via migration:run results in the execution of arbitrary JavaScript code within the context of the running Node.js process.\nThe impact is severe, potentially leading to full system compromise, data exfiltration, or unauthorized execution of operating system commands depending on the privileges of the Node.js application.\nRemediation requires upgrading TypeORM to version 0.3.31, 1.1.0, or later.",
  "technicalDetails": "The vulnerability resides in the src/commands/MigrationGenerateCommand.ts file of TypeORM, where the migration:generate feature introspects the connected database schema to automatically construct migration scripts.\nDuring the code generation process, database schema metadata—such as column COMMENT or DEFAULT field values—is extracted and embedded directly into JavaScript or TypeScript template literals within the output migration file.\nWhile the implementation escapes backtick characters to prevent literal syntax breakage, it fails to sanitize or escape template literal interpolation syntax (${...}).\nAn attacker possessing database schema write access can supply a crafted payload containing JavaScript expressions enclosed in ${...} syntax within introspectable schema fields.\nThe step-by-step attack flow begins with the attacker modifying database schema metadata to include a malicious payload.\nNext, an administrator or developer executes the vulnerable migration:generate command against the compromised database.\nTypeORM reads the malicious metadata string and writes it unescaped into the generated migration file's template literal.\nFinally, when the application executes the migration via migration:run, or when the migration file is dynamically imported or required by the Node.js runtime, the JavaScript engine evaluates the embedded template expression.\nThis triggers the execution of the attacker's payload with the privileges of the Node.js application process.\nThe affected product is TypeORM across versions prior to 0.3.31 and 1.1.0.\nExploitation requires the attacker to possess database schema write access to inject the payload, and requires the execution of migration commands by the application maintainers."
}