CVE-2026-61685: ReactPress has SQL injection via dynamic column names in TypeORM query builders
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. article.${key} ). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ReactPressto a version that resolves this vulnerability.Fixed in 3.7.0 - Configuration
Allowlist permitted filter column names before interpolating them into SQL.
ReactPress API list endpoints allowed filter column names = allowlisted
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
ReactPress deployments running a version before 3.7.0 are affected where the vulnerable API list endpoints are reachable. The flaw can be reached over the network without authentication or user interaction.
What must an attacker send to exploit it?
An attacker needs to send crafted HTTP query-string parameter names to a vulnerable API list endpoint. The parameter names are interpolated as SQL column identifiers, which TypeORM does not parameterize.
Is there a mitigation if upgrading is not immediately possible?
Allowlist the permitted filter column names before they are interpolated into SQL. This prevents untrusted query parameter names from being used as column identifiers.
How can I determine whether an instance needs remediation?
Check the deployed ReactPress version and review API list endpoint query construction. Versions earlier than 3.7.0 that use HTTP query parameter names in TypeORM QueryBuilder column expressions require remediation.