CVE-2026-76848: TypeORM 0.2.21 through 1.1.0 SQL Injection via SelectQueryBuilder.distinctOn
TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated statement as SELECT DISTINCT ON (values), with no escaping, quoting, identifier validation or allowlist, and without routing the values through replacePropertyNames or the driver's escape helper. Because the interpolation point is a parenthesized SQL expression list rather than an identifier-only position, a supplied element may carry arbitrary expressions, including correlated subqueries. An application that forwards a client-controlled value into distinctOn, for instance to let a caller choose a deduplication column, allows that client to read data anywhere the application's database role can reach through boolean or time-based inference, independently of the entity being queried. validateOrderByCondition, the allowlist check guarding the orderBy family in the same class, is not applied to this path.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using affected TypeORM versions with a PostgreSQL-family driver are exposed if they pass client-controlled strings, directly or indirectly, to SelectQueryBuilder.distinctOn. The risk exists even when the queried entity itself does not contain the data an attacker seeks.
Does exploiting this require authentication or user interaction?
No. The provided severity vector indicates network-reachable exploitation with low complexity, no privileges, and no user interaction, provided an attacker can influence a value supplied to distinctOn.
What data could an attacker access?
An attacker may use arbitrary SQL expressions, including correlated subqueries, to infer data through boolean- or time-based techniques. Exposure is limited by the database permissions of the application's configured database role, not by the entity being queried.
What should teams do if they cannot update immediately?
Do not forward client-controlled values into distinctOn. Restrict any selectable deduplication fields to a fixed application-defined allowlist before constructing the query.
How can teams identify vulnerable code paths?
Review uses of SelectQueryBuilder.distinctOn, especially features that accept a caller-selected column or deduplication field. Values reaching distinctOn are not validated, escaped, quoted, or checked by the orderBy allowlist validation path.