{"vulnerability": "GHSA-2RP8-MM9Q-FP49", "sightings": [{"uuid": "a2df4b48-ac12-4254-8504-d8e209bfcd59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2RP8-MM9Q-FP49", "type": "seen", "source": "https://gist.github.com/alon710/200e1b4ca9b1b66d608a6e02108ba259", "content": "# GHSA-2RP8-MM9Q-FP49: GHSA-2RP8-MM9Q-FP49: Remote Code Execution via Template-Literal Code Injection in TypeORM migration:generate\n\n> **CVSS Score:** 8.0\n> **Published:** 2026-07-21\n> **Full Report:** https://cvereports.com/reports/GHSA-2RP8-MM9Q-FP49\n\n## Summary\nA critical second-order code injection vulnerability exists in the migration generation engine of TypeORM. When TypeORM introspects a database schema to automatically generate migration files, it writes schema metadata directly into JavaScript/TypeScript migration files inside ES2015 template literals. Because the generator failed to sanitize template literal string interpolation markers and backslashes, attackers with control over database metadata can execute arbitrary code on the developer environment or within a CI/CD pipeline.\n\n## TL;DR\nTypeORM versions prior to 0.3.31 fail to escape backslashes and template interpolation sequences (`${`) when writing database schema comments and defaults to generated migration files. This allows attackers to execute arbitrary code via poisoned database metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-116, CWE-74\n- **Attack Vector**: Network (Second-order via database metadata)\n- **CVSS Score**: 8.0 (High)\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: PoC Documented\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- TypeORM before 0.3.31\n- TypeORM before 1.1.0\n- **typeorm**: < 0.3.31 (Fixed in: `0.3.31`)\n- **typeorm**: >= 1.0.0 < 1.1.0 (Fixed in: `1.1.0`)\n\n## Mitigation\n\n- Upgrade TypeORM to version 0.3.31 or 1.1.0 immediately.\n- Enforce the Principle of Least Privilege (PoLP) on the database credentials utilized by the runtime application to prevent administrative commands.\n- Implement static analysis rules or file-integrity monitors to scan generated migrations for unescaped code execution segments.\n\n**Remediation Steps:**\n1. Execute the dependency update command in your package manager: `npm install typeorm@0.3.31` or `npm install typeorm@1.1.0`.\n2. Review historical migration scripts inside your codebase for any suspicious `process` or `child_process` execution logic.\n3. Configure your production database roles to disallow `COMMENT ON` or `ALTER TABLE` operations for ordinary database users.\n\n## References\n\n- [GitHub Security Advisory GHSA-2RP8-MM9Q-FP49](https://github.com/advisories/GHSA-2RP8-MM9Q-FP49)\n- [TypeORM Fix Commit - ReplaceAll Sanitization](https://github.com/typeorm/typeorm/commit/41d1c62fe49f99c3ca916d4d986f61ee9f45d519)\n- [TypeORM Fix Commit - Regex Target Patch](https://github.com/typeorm/typeorm/commit/b175f9b8be422edd2a2ac035ba90c3f2ce782dfe)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-2RP8-MM9Q-FP49) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-22T08:31:19.319434Z"}]}