typeorm vulnerabilities

Products

• typeorm 2

Latest typeorm CVEs

Newest publication first

1. CVE-2026-73651 TypeORM: migration:generate template-literal code injection

   Published 2026-08-13

   Medium·CVSS 5.7

   TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template...

2. CVE-2020-8158 TypeORM vulnerable to MAID and Prototype Pollution

   Published 2020-09-18

   Critical·CVSS 9.8 EPSS 2.1%

   Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.