CVE-2026-61685: ReactPress SQL Injection Vulnerability

CVE-2026-61685 Overview

ReactPress, a publishing system for React developers, contains a SQL injection vulnerability in its API list endpoints. Versions prior to 3.7.0 construct TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers, such as `article.${key}`. While TypeORM parameterizes values, it does not sanitize column names, enabling unauthenticated attackers to inject SQL through crafted query string keys. The flaw is tracked as [CWE-89] SQL Injection. Version 3.7.0 contains the patch.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through query parameter names, leading to disclosure of sensitive data from the ReactPress database.

Affected Products

ReactPress versions prior to 3.7.0
ReactPress server/src/modules/article list endpoints
ReactPress server/src/modules/comment list endpoints

Discovery Timeline

2026-09-22 - CVE-2026-61685 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61685

Vulnerability Analysis

The vulnerability resides in ReactPress list endpoints that accept arbitrary query string parameters and pass their keys directly into TypeORM QueryBuilder conditions. The server interpolates each incoming parameter name into a SQL identifier of the form `article.${key}`. TypeORM safely parameterizes the value bound to a placeholder, but does not sanitize or validate the column identifier itself. An attacker who supplies a crafted key can therefore break out of the identifier context and inject arbitrary SQL fragments into the compiled query.

Because the endpoints do not require authentication, exploitation requires only network access to the ReactPress HTTP API. Successful injection can expose sensitive rows, enumerate schema, or extract authentication material stored in the database.

Root Cause

The root cause is missing allowlist validation on dynamic column identifiers. The list handlers iterate over req.query entries and build filter clauses by string-interpolating each key into the SQL fragment. No check confirms that the key corresponds to a real, permitted column on the article or comment entities before the identifier reaches the query builder.

Attack Vector

The attack vector is a network-reachable HTTP request to a vulnerable list endpoint. An attacker crafts a query string whose parameter name contains SQL metacharacters or a subquery fragment. When the server assembles the WHERE clause, the malicious key is concatenated into the query text and executed by the database.

typescript

// Patch excerpt: server/src/modules/article/article.service.ts
 import { Repository } from 'typeorm';
 
 import { dateFormat } from '../../utils/date.util';
+import { filterByWhitelist } from '../../utils/query-whitelist.util';
 import { CategoryService } from '../category/category.service';
 import { TagService } from '../tag/tag.service';
 import { WebhookService } from '../webhook/webhook.service';

Source: GitHub Commit 78ecb70

The fix introduces a filterByWhitelist helper that restricts dynamic query columns to a known-safe set before they are interpolated into SQL. A companion change in the comment controller adds @UseGuards(JwtAuthGuard) to reduce the unauthenticated attack surface:

typescript

// Patch excerpt: server/src/modules/comment/comment.controller.ts
   @ApiResponse({ status: 200, description: '创建评论', type: [Comment] })
   @Post()
+  @UseGuards(JwtAuthGuard)
   create(@Request() req, @Body() comment) {
     const userAgent = req.headers['user-agent'];
     return this.commentService.create(userAgent, comment);

Source: GitHub Commit 78ecb70

Detection Methods for CVE-2026-61685

Indicators of Compromise

HTTP requests to ReactPress list endpoints containing unusual query parameter names with SQL metacharacters such as backticks, parentheses, UNION, SELECT, or --.
Web server access logs showing extremely long or URL-encoded query string keys targeting /api/article or similar list routes.
Database error entries referencing malformed identifiers in article.* or comment.* columns.

Detection Strategies

Inspect application and reverse proxy logs for query parameter keys that do not match the expected allowlist of filter columns.
Deploy web application firewall rules that flag SQL keywords appearing inside HTTP parameter names, not just values.
Correlate anomalous ReactPress query patterns with spikes in database read volume or slow-query logs.

Monitoring Recommendations

Enable verbose logging of TypeORM generated SQL in non-production environments to baseline legitimate query shapes.
Alert on repeated 500-level responses from /api/article and /api/comment endpoints, which often accompany injection probing.
Monitor egress from the ReactPress database host for unexpected bulk data transfers.

How to Mitigate CVE-2026-61685

Immediate Actions Required

Upgrade ReactPress to version 3.7.0 or later, which includes the filterByWhitelist sanitization helper.
Restrict network exposure of ReactPress API endpoints to trusted origins until the upgrade is complete.
Rotate any secrets, session tokens, or credentials stored in the ReactPress database if exploitation is suspected.

Patch Information

The fix is delivered in ReactPress v3.7.0 and implemented in commit 78ecb70. See the GitHub Security Advisory GHSA-wmw4-mw6x-6vfm for the full disclosure.

Workarounds

Allowlist permitted filter column names in application code before interpolating them into any SQL fragment.
Reject requests whose query parameter keys fall outside the documented API surface at a reverse proxy or WAF layer.
Require authentication on list and comment endpoints where feasible to limit unauthenticated exploitation.

bash

# Example nginx rule: drop requests whose query string keys contain SQL metacharacters
if ($args ~* "(^|&)[^=&]*(select|union|--|`|\()[^=&]*=") {
    return 400;
}