GHSA-2rp8-mm9q-fp49: TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not ${...}. An attacker who can write schema metadata (column comments, defaults, view definitions) achieves arbitrary code execution on the host that loads the generated migration. Details MigrationGenerateCommand.ts (L117-138) wraps each SQL statement in a JS template literal, escaping only backticks: " await queryRunner.query(`" + upQuery.query.replaceAll("", "\\") + "`" + ... Introspected schema strings reach this sink through driver query runners: | Driver | Metadata source | Source | |---|---|---| | Postgres | column DEFAULT, COMMENT, CHECK constraints, view definitions | PostgresQueryRunner.ts:1782, L1898, L2287, L4125 | | MySQL/MariaDB | COLUMN_DEFAULT, COLUMN_COMMENT | MysqlQueryRunner.ts:2873-2974, L3580-3583 | | CockroachDB | Same patterns as Postgres | CockroachQueryRunner.ts | escapeComment() on each driver strips only null bytes, leaving ${...} intact: protected escapeComment(comment?: string) { if (!comment) return comment comment = comment.replaceAll("\u0000", "") return comment } When the migration file is loaded (migration:run, import, or require), the JS engine evaluates ${...} as live interpolation. Affected source: | File | Lines | Role | |---|---|---| | MigrationGenerateCommand.ts | 117-138 | Template-literal construction (sink) | | PostgresDriver.ts | 1886-1891 | escapeComment() — Postgres | | MysqlDriver.ts | 1322-1328 | escapeComment() — MySQL | | CockroachDriver.ts | 1236-1241 | escapeComment() — CockroachDB | Confirmed injection vectors (MySQL): | Vector | Result | Notes | |---|---|---| | Column COMMENT | Confirmed | Proven in PoC below | | Column DEFAULT | Confirmed | Attacker sets ALTER TABLE ... DEFAULT '${...}'; payload appears in generated migration | | CHECK constraint | Not exploitable | MySQL information_schema.CHECK_CONSTRAINTS strips content from CHECK_CLAUSE | | View definitions | Not tested | Requ