CVE-2026-73651
Description
A flaw was found in TypeORM. TypeORM's migration:generate command, used for generating database migrations, embeds database schema metadata into JavaScript or TypeScript template literals. This process incorrectly escapes backticks but fails to escape interpolation, creating a vulnerability. An attacker with write access to the database schema can exploit this by injecting a malicious payload into column COMMENT or DEFAULT metadata. When the generated migration is subsequently loaded, the JavaScript engine evaluates this payload, leading to arbitrary code execution.
Statement
TypeORM's migration:generate command builds JavaScript or TypeScript migration files by embedding database schema metadata, such as column comments and default values, into template literals. Prior to versions 0.3.31 and 1.1.0, this process escaped backticks but not ${...} template interpolation. An attacker who already holds write access to the database schema could place a malicious payload in a column's COMMENT or DEFAULT metadata; the payload executes as JavaScript when the generated migration file is later loaded via migration:run, import, or require.
This issue is rated Moderate. Exploitation requires an attacker to already have elevated, direct write access to the affected database schema, a condition not exposed through any Red Hat product's normal user-facing interfaces, and requires an administrator to subsequently run migration:generate against that compromised schema and load the resulting file. Red Hat's CVSS assessment matches the reporting vendor's own score.
Mitigation
No mitigation is available beyond upgrading to a fixed TypeORM release (0.3.31 or 1.1.0 or later) when available for the affected product. In the meantime, administrators should restrict write access to production database schema metadata (table and column comments and default values) and review generated migration files before running migration:run, import, or require against them.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.7 | N/A | 5.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | High | N/A | High |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
