Code Injection Vulnerability in TypeORM Affects Multiple Database Platforms
CVE-2026-73651
What is CVE-2026-73651?
TypeORM, a popular Object-Relational Mapping library for Node.js, contains a code injection vulnerability that can be exploited by attackers with write access to a database schema. This vulnerability arises when database schema metadata is embedded in JavaScript or TypeScript template literals. Specifically, the issue lies in the handling of column COMMENT or DEFAULT metadata, or other introspected schema strings, during the migration generation process. An attacker could inject malicious payloads that would be executed by the JavaScript engine when the migration is loaded via migration:run, import, or require. This critical flaw has been addressed in versions 0.3.31 and 1.1.0, underscoring the importance of upgrading to secure versions.
Affected Version(s)
typeorm < 0.3.31 < 0.3.31
typeorm >= 1.0.0, < 1.1.0 < 1.0.0, 1.1.0