Medium [CVE-2026-73651] Arbitrary code execution via template literal code injection
This medium-severity Red Hat Linux advisory covers CVE-2026-73651 affecting Red Hat Developer Hub, Self-service automation portal 2.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases.
Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation.
An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0.
A flaw was found in TypeORM. This process incorrectly escapes backticks but fails to escape interpolation, creating a vulnerability.
TypeORM's migration:generate command builds JavaScript or TypeScript migration files by embedding database schema metadata, such as column comments and default values, into template literals. This issue is rated Moderate.
Exploitation requires an attacker to already have elevated, direct write access to the affected database schema, a condition not exposed through any Red Hat product's normal user-facing interfaces, and requires an administrator to subsequently run migration:generate against that compromised schema and load the resulting file.
- < 0.3.31
- < 1.1.0
Official advisory · high-confidence parse· fetched 29 days ago·verify at source
- 0.3.31
- 1.1.0
Official advisory · high-confidence parse· fetched 29 days ago·verify at source
Mitigation checklist
- No mitigation is available beyond upgrading to a fixed TypeORM release (0.3.31 or 1.1.0 or later) when available for the affected product. In the meantime, administrators should restrict write access to production database schema metadata (table and column comments and default values) and review generated migration files before running migration:run, import, or require against them.
Official advisory · high-confidence parse· fetched 29 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.