AIKIDO-2026-567761
@mikro-orm/entity-generator is vulnerable to Code Injection
37
Low Risk
This Affects:
@mikro-orm/entity-generatorTL;DR
The entity generator embeds database-introspected strings such as column comments, table comments, and native enum labels into generated TypeScript as string literals. The shared quote() helper in SourceFile.ts escapes single quotes but not backslashes, and its backtick branch does not neutralize ${...} interpolation, so a crafted value can terminate the generated literal early and turn the remainder into executable code. When entity generation runs against a schema a third party can write DDL into, the generated file executes injected code once it is loaded or compiled. The fix escapes backslashes before quotes and neutralizes ${ in the template-literal branch.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the entity generator against a database schema whose object comments or native enum labels can be set by an untrusted party.
Background info
@mikro-orm/entity-generator is vulnerable to Code Injection in versions 0.0.1 - 7.1.8.
How to fix this
Upgrade the @mikro-orm/entity-generator library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant