Code Injection Vulnerability in TypeORM: Migration Generation
Summary
GHSA-2rp8-mm9q-fp49: TypeORM: migration:generate template-literal code injection. Affects typeorm across 2 version ranges.
< 0.3.31
>= 1.0.0, < 1.1.0
Fixed in 0.3.31 or 1.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TypeORM is an open-source Object-Relational Mapping (ORM) library for TypeScript and JavaScript that enables developers to interact with databases using an object-oriented approach. It supports various databases, including PostgreSQL, MySQL, and MariaDB. The library allows for seamless database migrations, schema management, and data manipulation. However, a critical vulnerability has been identified in the migration generation process, which could allow attackers to execute arbitrary code on the host machine.
Vulnerability Detail
The vulnerability arises from the way TypeORM handles database schema metadata during the migration generation process. Specifically, the migration:generate command embeds this metadata into JavaScript/TypeScript template literals, escaping backticks but failing to escape ${...}. This oversight allows an attacker with write access to the database schema (through column comments, defaults, or view definitions) to inject malicious code. When the generated migration file is loaded, the JavaScript engine evaluates the injected code, leading to potential remote code execution (RCE) on the host running the migration.
How To Fix
Latest published version: 1.1.2 as of 22 Oct 2026
npm install typeorm@1.1.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.3.310.3.31npm install typeorm@0.3.31 -
>= 1.0.0, < 1.1.01.1.0npm install typeorm@1.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the migration:generate command on databases where schema metadata can be influenced by untrusted users. Additionally, ensure that any user with write access to the database schema is trusted and has limited privileges.
Conclusion
The code injection vulnerability in TypeORM's migration generation process poses a significant risk to applications that utilize this ORM. By understanding the nature of the vulnerability, applying the necessary updates, and implementing workarounds, developers can protect their applications from potential exploitation.
See every vulnerability recorded for typeorm →
FAQ
An attacker with write access to the database schema can execute arbitrary JavaScript code on the host machine, potentially leading to data breaches or system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
The vulnerability affects TypeORM versions prior to 0.3.31 and 1.1.0. Ensure you are using the latest version to mitigate the risk.
If immediate updates are not possible, implement the suggested workaround by restricting write access to the database schema and avoiding the use of the migration:generate command.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for typeorm.
