CVE-2026-61685: ReactPress has SQL injection via dynamic column names in TypeORM query builders

September 23, 2026

ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `article.${key}`). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys.

References

github.com/advisories/GHSA-wmw4-mw6x-6vfm
github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6
github.com/fecommunity/reactpress/releases/tag/v3.7.0
github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm
nvd.nist.gov/vuln/detail/CVE-2026-61685

Code Behaviors & Features

Detect and mitigate CVE-2026-61685 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →