Threats affecting pkg:npm/typeorm

TypeORM's migration:generate command embeds database schema metadata into JavaScript/TypeScript template literals without properly escaping template interpolation syntax `${...}`. This allows an attacker who can write schema metadata such as column comments or defaults to inject arbitrary code that executes when the generated migration file is loaded. The vulnerability affects TypeORM versions before 0.3.31 and versions from 1.0.0 up to but not including 1.1.0.

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.