GHSA-2RP8-MM9Q-FP49: GHSA-2RP8-MM9Q-FP49: Remote Code Execution via Template-Literal Code Injection in TypeORM migration:generate

GHSA-2RP8-MM9Q-FP49: Remote Code Execution via Template-Literal Code Injection in TypeORM migration:generate

Vulnerability ID: GHSA-2RP8-MM9Q-FP49
CVSS Score: 8.0
Published: 2026-07-21

A critical second-order code injection vulnerability exists in the migration generation engine of TypeORM. When TypeORM introspects a database schema to automatically generate migration files, it writes schema metadata directly into JavaScript/TypeScript migration files inside ES2015 template literals. Because the generator failed to sanitize template literal string interpolation markers and backslashes, attackers with control over database metadata can execute arbitrary code on the developer environment or within a CI/CD pipeline.

TL;DR

TypeORM versions prior to 0.3.31 fail to escape backslashes and template interpolation sequences (${) when writing database schema comments and defaults to generated migration files. This allows attackers to execute arbitrary code via poisoned database metadata.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-94, CWE-116, CWE-74
• Attack Vector: Network (Second-order via database metadata)
• CVSS Score: 8.0 (High)
• Impact: Remote Code Execution (RCE)
• Exploit Status: PoC Documented
• KEV Status: Not Listed

Affected Systems

• TypeORM before 0.3.31
• TypeORM before 1.1.0
• typeorm: < 0.3.31 (Fixed in: 0.3.31)
• typeorm: >= 1.0.0 < 1.1.0 (Fixed in: 1.1.0)

Code Analysis

Commit: 41d1c62

Fix migration generation command backslash escaping issues using replaceAll

Commit: b175f9b

Adjust template escaping utility to utilize regex for legacy engine compatibility

Exploit Details

• GitHub Security Advisory: Detailed description of the template breakout vectors and structural analysis.

Mitigation Strategies

• Upgrade TypeORM to version 0.3.31 or 1.1.0 immediately.
• Enforce the Principle of Least Privilege (PoLP) on the database credentials utilized by the runtime application to prevent administrative commands.
• Implement static analysis rules or file-integrity monitors to scan generated migrations for unescaped code execution segments.

Remediation Steps:

1. Execute the dependency update command in your package manager: npm install typeorm@0.3.31 or npm install typeorm@1.1.0.
2. Review historical migration scripts inside your codebase for any suspicious process or child_process execution logic.
3. Configure your production database roles to disallow COMMENT ON or ALTER TABLE operations for ordinary database users.

References

• GitHub Security Advisory GHSA-2RP8-MM9Q-FP49
• TypeORM Fix Commit - ReplaceAll Sanitization
• TypeORM Fix Commit - Regex Target Patch

---

Read the full report for GHSA-2RP8-MM9Q-FP49 on our website for more details including interactive diagrams and full exploit analysis.