TypeORM: migration:generate template-literal code injection

Description

typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not ${...}. An attacker who can write schema metadata (column comments, defaults, view definitions) achieves arbitrary code execution on the host that loads the generated migration.

Recommendation

Update the typeorm package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.0.0, < 1.1.0

  < 0.3.31**

• Patched version(s): **1.1.0

  0.3.31**

References

• GHSA-2rp8-mm9q-fp49
• CVE-2026-73651
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion - CVE-2026-46580
• [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code - CVE-2026-46580
• lodash vulnerable to Code Injection via `_.template` imports key names - lodash-amd - CVE-2026-4800
• lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

typeorm