CVE-2026-61685
Received Received - Intake

SQL Injection in ReactPress Publishing System

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-61685

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
reactpress reactpress to 3.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ReactPress before version 3.7.0 has a vulnerability where API list endpoints use unsanitized HTTP query parameter names directly as SQL column identifiers in TypeORM QueryBuilder. This allows SQL injection since TypeORM parameterizes values but not column names. Attackers can exploit this without authentication by crafting malicious query strings.

Detection Guidance

Check if your ReactPress instance is running a version prior to 3.7.0. Inspect HTTP requests to API endpoints for unusual query parameters containing SQL-like syntax or special characters. Monitor database logs for unexpected queries or errors.

Impact Analysis

Unauthenticated attackers could manipulate SQL queries to access, modify, or delete database contents. This may lead to unauthorized data exposure, data corruption, or denial of service. Systems using vulnerable ReactPress versions are at risk of complete database compromise.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security such as GDPR (data breach notification) and HIPAA (unauthorized access to PHI). It enables unauthorized data access, which could result in regulatory penalties, legal liabilities, and loss of trust.

Mitigation Strategies

Upgrade ReactPress to version 3.7.0 or later. If immediate upgrade is not possible, implement a workaround by validating and allowlisting query parameter names before using them in SQL queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61685. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart