CVE-2026-73651

TypeORM versions prior to 0.3.31 contain a template literal injection vulnerability in the migration generator. When introspecting database schema metadata (table names, column names, comments, DEFAULT values), the generator escapes backticks to prevent template literal termination but fails to escape `${` sequences. This allows an attacker with write access to a development database schema to inject arbitrary JavaScript that executes on every machine running `typeorm migration:run` or `typeorm migration:generate` against that schema. The CVSS score of 5.7 fundamentally misrepresents the actual risk because it measures only the direct impact of loading a malicious migration, not the cascade. In practice, schema write access in development environments is broadly granted—to tools, onboarding scripts, CI service accounts, and developer GUIs. Compromising a shared development database places executable payloads in every developer's local environment, every CI pipeline that validates schema state, and every pre-commit hook that imports generated migrations. The attacker's reach extends far beyond the database they can write to, into machines they have no direct access to. More critically, patching TypeORM does not sanitize migrations already committed to version control. If an attacker compromised a development schema months before this CVE was disclosed, the malicious payload exists now in `migrations/*.ts` files across every fork, branch, and cloned repository. Patching the tool closes the faucet but leaves poisoned water in the reservoir. Audit your git history for migration files generated during any period of suspected schema compromise. Treat database schema metadata as untrusted input to code generation—update your threat model to position schema introspection as an injection vector rather than a trusted data source. This same pattern (template literal injection via introspected metadata) has surfaced in build tools and documentation generators; other ORM code generators likely make identical trust assumptions and should be audited. The fix in 0.3.31 is a single-line escape addition, which suggests the underlying trust assumption remains unchallenged in the codebase—not just in TypeORM, but wherever schema metadata flows into generated code without sanitization.

Reviewed through automated stages and approved by a human before publication.