GHSA-WMW4-MW6X-6VFM

Vulnerability from github – Published: 2026-09-23 21:51 – Updated: 2026-09-23 21:51
VLAI
Summary
ReactPress has SQL injection via dynamic column names in TypeORM query builders
Details

Summary

ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `article.${key}`). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys.

Impact

An unauthenticated remote attacker can perform blind SQL injection against the application database, potentially exfiltrating sensitive data (users, settings, API keys, article content, etc.).

Affected endpoints (unauthenticated GET)

  • GET /api/article
  • GET /api/comment
  • GET /api/file
  • GET /api/page
  • GET /api/Knowledge

Affected code

Vulnerable pattern in findAll() methods, including but not limited to:

  • server/src/modules/article/article.service.ts
  • server/src/modules/comment/comment.service.ts
  • server/src/modules/file/file.service.ts
  • server/src/modules/page/page.service.ts
  • server/src/modules/knowledge/knowledge.service.ts

Remediation

  • Whitelist allowed filter column names before interpolating into SQL.
  • Upgrade to @fecommunity/reactpress >= 3.7.0.

Credit

Reported by lsr365400.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@fecommunity/reactpress"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61685"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T21:51:59Z",
    "nvd_published_at": "2026-09-22T23:17:07Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nReactPress API list endpoints build TypeORM `QueryBuilder` conditions using\nunsanitized HTTP query parameter *names* as SQL column identifiers\n(e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column\nnames, allowing unauthenticated attackers to inject SQL through crafted\nquery string keys.\n\n## Impact\n\nAn unauthenticated remote attacker can perform blind SQL injection against\nthe application database, potentially exfiltrating sensitive data (users,\nsettings, API keys, article content, etc.).\n\n## Affected endpoints (unauthenticated GET)\n\n- `GET /api/article`\n- `GET /api/comment`\n- `GET /api/file`\n- `GET /api/page`\n- `GET /api/Knowledge`\n\n## Affected code\n\nVulnerable pattern in `findAll()` methods, including but not limited to:\n\n- `server/src/modules/article/article.service.ts`\n- `server/src/modules/comment/comment.service.ts`\n- `server/src/modules/file/file.service.ts`\n- `server/src/modules/page/page.service.ts`\n- `server/src/modules/knowledge/knowledge.service.ts`\n\n## Remediation\n\n- Whitelist allowed filter column names before interpolating into SQL.\n- Upgrade to `@fecommunity/reactpress` \u003e= 3.7.0.\n\n## Credit\n\nReported by lsr365400.",
  "id": "GHSA-wmw4-mw6x-6vfm",
  "modified": "2026-09-23T21:51:59Z",
  "published": "2026-09-23T21:51:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61685"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fecommunity/reactpress"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fecommunity/reactpress/releases/tag/v3.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ReactPress has SQL injection via dynamic column names in TypeORM query builders"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.