GHSA-2rp8-mm9q-fp49: TypeORM: migration:generate template-literal code injection
(updated )
typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not ${...}. An attacker who can write schema metadata (column comments, defaults, view definitions) achieves arbitrary code execution on the host that loads the generated migration.
References
- github.com/advisories/GHSA-2rp8-mm9q-fp49
- github.com/typeorm/typeorm/commit/41d1c62fe49f99c3ca916d4d986f61ee9f45d519
- github.com/typeorm/typeorm/commit/b175f9b8be422edd2a2ac035ba90c3f2ce782dfe
- github.com/typeorm/typeorm/releases/tag/0.3.31
- github.com/typeorm/typeorm/releases/tag/1.1.0
- github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49
- nvd.nist.gov/vuln/detail/CVE-2026-73651
Code Behaviors & Features
Detect and mitigate GHSA-2rp8-mm9q-fp49 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →