AIKIDO-2026-567761

@mikro-orm/entity-generator is vulnerable to Code Injection

GHSA-vr2q-6mwx-8248Published Aug 5, 2026

CVE Score

Low

Code Injection

TL;DR

The entity generator embeds database-introspected strings such as column comments, table comments, and native enum labels into generated TypeScript as string literals. The shared quote() helper in SourceFile.ts escapes single quotes but not backslashes, and its backtick branch does not neutralize ${...} interpolation, so a crafted value can terminate the generated literal early and turn the remainder into executable code. When entity generation runs against a schema a third party can write DDL into, the generated file executes injected code once it is loaded or compiled. The fix escapes backslashes before quotes and neutralizes ${ in the template-literal branch.

How do I fix this?

Upgrade the @mikro-orm/entity-generator library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the entity generator against a database schema whose object comments or native enum labels can be set by an untrusted party.