SQL Injection Vulnerability in ReactPress Publishing System
CVE-2026-61685
What is CVE-2026-61685?
ReactPress, a publishing system designed for React developers, reveals a significant vulnerability prior to version 3.7.0. This vulnerability arises from the way the API list endpoints construct TypeORM QueryBuilder conditions utilizing unsanitized HTTP query parameter names as SQL column identifiers. While TypeORM handles value parameterization effectively, it does not extend this protective measure to column names, leaving the system exposed to potential SQL injection attacks. By manipulating crafted query string keys, unauthenticated attackers can exploit this weakness to execute unauthorized commands on the database. ReactPress version 3.7.0 addresses this issue, and it is strongly advised to implement a workaround by restrictively allowlisting permitted filter column names before their inclusion in SQL queries.
Affected Version(s)
reactpress < 3.7.0