{"id":"CVE-2026-61685","title":"ReactPress is a publishing system for React developers","summary":"ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `articl…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-89"],"vendor":"fecommunity","product":"reactpress","affected":["reactpress < 3.7.0"],"published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T23:17:07.600","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61685","references":[{"url":"https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6","label":"security-advisories@github.com"},{"url":"https://github.com/fecommunity/reactpress/releases/tag/v3.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-23T00:14:05.312Z","slug":"CVE-2026-61685","body":"## Overview\n\nReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}