The vulnerability in TypeORM’s migration:generate command allows an attacker who can write to the database schema to embed a payload in metadata fields such as COMMENT or DEFAULT. The command places schema details inside JavaScript or TypeScript template literals but fails to escape the ${...} interpolation syntax. When the generated migration is subsequently run, imported, or required, the JavaScript engine evaluates the payload, enabling the attacker to execute arbitrary code with the privileges of the running process.

TypeORM, versions earlier than 0.3.31 and 1.1.0, are affected. Any installation of the ORM that uses migration:generate before either of those release points and does not prohibit schema write access to untrusted actors is vulnerable.

The CVSS score of 5.7 indicates a medium severity risk from the point of view of the affected application. Exposure requires that an attacker have the ability to modify the database schema and that the generated migration file be executed in the application context—conditions that are typical in environments that automatically apply migrations or allow privileged users to trigger them. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the attack path remains feasible on any system that does not isolate schema modifications and execution of migration scripts.