PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73651 typeorm CVE debrief

CVE-2026-73651 is a code injection vulnerability in TypeORM, a TypeScript and JavaScript ORM for Node.js. An attacker with database schema write access can inject malicious code via column COMMENT or DEFAULT metadata, which is executed when the generated migration is loaded. Defenders should verify exposure in Node.js environments using TypeORM versions before 0.3.31 and 1.1.0, assess database schema metadata integrity, and upgrade to fixed versions. The CVE record was published on 2026-08-13T19:17:38.617Z and has not been modified since then.

Vendor
typeorm
Product
Unknown
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-13
Original CVE updated
2026-09-18
Advisory published
2026-08-13
Advisory updated
2026-09-18

Who should care

Defenders responsible for Node.js environments using TypeORM should assess exposure and prioritize verification of their database schema metadata. This includes developers, security teams, and DevOps personnel.

Why it matters

CVE-2026-73651 allows code injection via database schema metadata in TypeORM, requiring defenders to verify exposure and prioritize remediation in Node.js environments.

  • Code injection via database schema metadata
  • Potential for malicious code execution
  • Need for verification of exposure in Node.js environments
  • Priority for upgrading to fixed TypeORM versions

Technical summary

The TypeORM library for Node.js is vulnerable to code injection via database schema metadata. An attacker with write access to the database schema can inject malicious code, which is then executed when the generated migration is loaded through migration:run, import, or require. The vulnerability is fixed in TypeORM versions 0.3.31 and 1.1.0. Defenders should prioritize verifying exposure in Node.js environments using TypeORM versions before 0.3.31 and 1.1.0, and assess the integrity of their database schema metadata.

Defensive priority

Defenders should prioritize verifying exposure in Node.js environments using TypeORM versions before 0.3.31 and 1.1.0, and assess the integrity of their database schema metadata.

Recommended defensive actions

  • Verify Node.js environments using TypeORM versions before 0.3.31 and 1.1.0 for potential exposure
  • Assess the integrity of database schema metadata
  • Upgrade to TypeORM version 0.3.31 or 1.1.0 or later
  • Monitor for suspicious activity in Node.js environments
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in TypeORM, including the affected versions and fixed versions. However, there is limited information on potential exploitation or victim impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73651 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73651

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73651 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73651

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.