{"id":"CVE-2026-61685","aliases":["EUVD-2026-84981","GHSA-wmw4-mw6x-6vfm"],"status":"published","title":"ReactPress has SQL injection via dynamic column names in TypeORM query builders","description":"ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00535,"percentile":0.45444,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-09-22T23:08:58Z","modified":"2026-11-05T03:30:08Z","fixes":[{"ecosystem":"npm","package":"@fecommunity/reactpress","fixed_in":["3.7.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@fecommunity/reactpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.0"},{"fixed":"3.7.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@fecommunity/reactpress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.0"}]}]}],"products":[{"vendor":"fecommunity","product":"reactpress"},{"vendor":"rockiger","product":"reactpress"}],"references":[{"url":"https://github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/fecommunity/reactpress/releases/tag/v3.7.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61685","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wmw4-mw6x-6vfm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61685.json","tags":["advisory"]},{"url":"https://github.com/fecommunity/reactpress","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-61685","title":"ReactPress has SQL injection via dynamic column names in TypeORM query builders","description":"ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.","status":"published","published":"2026-09-22T23:08:58.323Z","modified":"2026-09-23T14:34:11.725Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-84981","description":"ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.","status":"published","published":"2026-09-22T23:08:58Z","modified":"2026-09-23T14:34:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:00.949397Z"}],"ghsa":[{"id":"GHSA-wmw4-mw6x-6vfm","title":"ReactPress has SQL injection via dynamic column names in TypeORM query builders","description":"## Summary\n\nReactPress API list endpoints build TypeORM `QueryBuilder` conditions using\nunsanitized HTTP query parameter *names* as SQL column identifiers\n(e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column\nnames, allowing unauthenticated attackers to inject SQL through crafted\nquery string keys.\n\n## Impact\n\nAn unauthenticated remote attacker can perform blind SQL injection against\nthe application database, potentially exfiltrating sensitive data (users,\nsettings, API keys, article content, etc.).\n\n## Affected endpoints (unauthenticated GET)\n\n- `GET /api/article`\n- `GET /api/comment`\n- `GET /api/file`\n- `GET /api/page`\n- `GET /api/Knowledge`\n\n## Affected code\n\nVulnerable pattern in `findAll()` methods, including but not limited to:\n\n- `server/src/modules/article/article.service.ts`\n- `server/src/modules/comment/comment.service.ts`\n- `server/src/modules/file/file.service.ts`\n- `server/src/modules/page/page.service.ts`\n- `server/src/modules/knowledge/knowledge.service.ts`\n\n## Remediation\n\n- Whitelist allowed filter column names before interpolating into SQL.\n- Upgrade to `@fecommunity/reactpress` \u003e= 3.7.0.\n\n## Credit\n\nReported by lsr365400.","status":"published","published":"2026-09-23T21:51:59Z","modified":"2026-09-23T21:52:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-61685","description":"ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.","status":"published","published":"2026-09-22T23:17:07.6Z","modified":"2026-09-23T18:12:04.247Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-61685","title":"ReactPress has SQL injection via dynamic column names in TypeORM query builders","description":"ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.","status":"published","published":"2026-09-22T23:08:58.323Z","modified":"2026-11-05T21:32:26.917761564Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T22:00:34.245765Z"},{"id":"GHSA-wmw4-mw6x-6vfm","title":"ReactPress has SQL injection via dynamic column names in TypeORM query builders","description":"## Summary\n\nReactPress API list endpoints build TypeORM `QueryBuilder` conditions using\nunsanitized HTTP query parameter *names* as SQL column identifiers\n(e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column\nnames, allowing unauthenticated attackers to inject SQL through crafted\nquery string keys.\n\n## Impact\n\nAn unauthenticated remote attacker can perform blind SQL injection against\nthe application database, potentially exfiltrating sensitive data (users,\nsettings, API keys, article content, etc.).\n\n## Affected endpoints (unauthenticated GET)\n\n- `GET /api/article`\n- `GET /api/comment`\n- `GET /api/file`\n- `GET /api/page`\n- `GET /api/Knowledge`\n\n## Affected code\n\nVulnerable pattern in `findAll()` methods, including but not limited to:\n\n- `server/src/modules/article/article.service.ts`\n- `server/src/modules/comment/comment.service.ts`\n- `server/src/modules/file/file.service.ts`\n- `server/src/modules/page/page.service.ts`\n- `server/src/modules/knowledge/knowledge.service.ts`\n\n## Remediation\n\n- Whitelist allowed filter column names before interpolating into SQL.\n- Upgrade to `@fecommunity/reactpress` \u003e= 3.7.0.\n\n## Credit\n\nReported by lsr365400.","status":"published","published":"2026-09-23T21:51:59Z","modified":"2026-09-23T22:00:04.424651102Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}