CyberRota Analysis
AI-GeneratedTypeORM versions prior to 0.3.31 and 1.1.0 are vulnerable to a code injection flaw that allows an attacker with write access to the database schema to embed malicious payloads in metadata, which can be executed when migrations are run. This could lead to unauthorized code execution within the application context, potentially compromising the system. Organizations using affected versions of TypeORM, particularly those with database schema write access, should prioritize upgrading to the fixed versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.