Potential Code Injection in typeorm npm Package: Early Warning
An early warning has been issued regarding a potential code injection vulnerability in the typeorm npm package, which could allow arbitrary code execution.
What happened
Reportedly, the typeorm npm package embeds database schema metadata into JavaScript/TypeScript template literals. This appears to enable an attacker with the ability to write schema metadata to achieve arbitrary code execution, as backticks are escaped but not `${...}` expressions. This issue is under investigation and has been tracked with the ID GHSA-2RP8-MM9Q-FP49.
To assess your exposure, it is recommended to upgrade to the latest version of typeorm and review any generated migration files for suspicious code. The affected versions include multiple ranges, with fixes introduced in versions 0.3.31, 1.1.0, 0.3.29, 0.3.0, 0.2.25, 0.3.26, and 0.1.15. For detailed version information, consult the primary sources.
How 0Day mitigates this
typeorm is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.