The TypeORM migration:generate command constructs migration files by embedding SQL statements inside JS/TS template literals, escaping backticks but not the `${...}` interpolation syntax. Schema metadata from various database drivers (Postgres, MySQL/MariaDB, CockroachDB) such as column comments and defaults are included without escaping `${`, allowing an attacker with write access to schema metadata to inject arbitrary JavaScript code. When the generated migration file is loaded (via migration:run, import, or require), the injected code executes. Confirmed injection vectors include MySQL column COMMENT and DEFAULT fields. The suggested fix is to escape `${` sequences or switch to safer string encoding methods.

An attacker with the ability to write schema metadata (e.g., column comments or defaults) can achieve arbitrary code execution on the host machine that loads the generated migration file. This can lead to full compromise of the development or CI environment where migrations are generated or run. The vulnerability does not affect runtime database operations but targets the migration generation and execution process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running migration:generate on databases where untrusted users can write schema metadata containing `${...}` sequences. Review and sanitize schema metadata inputs to prevent injection. Monitor official TypeORM repositories and advisories for patches that properly escape `${` in template literals or change the migration generation approach.