CVE-2026-73651: Typeorm

Medium severity, CVSS 5.7. EPSS: 0.4% chance of exploitation in the next 30 days.

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.

Affected products

• Typeorm Typeorm: before 0.3.31 (fixed in 0.3.31); from 1.0.0, before 1.1.0 (fixed in 1.1.0)

Published 2026-08-13. Last modified 2026-09-18.