{"id":"CVE-2026-61685","aliases":["GHSA-wmw4-mw6x-6vfm"],"url":"https://o3.security/vulnerability/CVE-2026-61685","summary":"ReactPress has SQL injection via dynamic column names in TypeORM query builders","details":"## Summary\n\nReactPress API list endpoints build TypeORM `QueryBuilder` conditions using\nunsanitized HTTP query parameter *names* as SQL column identifiers\n(e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column\nnames, allowing unauthenticated attackers to inject SQL through crafted\nquery string keys.\n\n## Impact\n\nAn unauthenticated remote attacker can perform blind SQL injection against\nthe application database, potentially exfiltrating sensitive data (users,\nsettings, API keys, article content, etc.).\n\n## Affected endpoints (unauthenticated GET)\n\n- `GET /api/article`\n- `GET /api/comment`\n- `GET /api/file`\n- `GET /api/page`\n- `GET /api/Knowledge`\n\n## Affected code\n\nVulnerable pattern in `findAll()` methods, including but not limited to:\n\n- `server/src/modules/article/article.service.ts`\n- `server/src/modules/comment/comment.service.ts`\n- `server/src/modules/file/file.service.ts`\n- `server/src/modules/page/page.service.ts`\n- `server/src/modules/knowledge/knowledge.service.ts`\n\n## Remediation\n\n- Whitelist allowed filter column names before interpolating into SQL.\n- Upgrade to `@fecommunity/reactpress` >= 3.7.0.\n\n## Credit\n\nReported by lsr365400.","published":"2026-09-22T23:08:58.323Z","modified":"2026-10-21T02:58:52.656109567Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@fecommunity/reactpress","fixedVersion":"3.7.0"}],"fix":{"url":"https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6","label":"fecommunity/reactpress@78ecb70"},"references":[{"type":"WEB","url":"https://github.com/fecommunity/reactpress/releases/tag/v3.7.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61685.json"},{"type":"ADVISORY","url":"https://github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61685"},{"type":"FIX","url":"https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6"},{"type":"PACKAGE","url":"https://github.com/fecommunity/reactpress"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:52.656109567Z"}}