SQL Injection Vulnerability in TypeORM's SelectQueryBuilder for PostgreSQL Drivers

CVE-2026-76848

What is CVE-2026-76848?

The vulnerability in TypeORM's SelectQueryBuilder allows an attacker to perform SQL injection through the distinctOn method. The method accepts an unvalidated array of strings which can lead to arbitrary SQL expressions being executed. As a result, if an application allows client-controlled input to influence the distinctOn value directly, it could inadvertently expose sensitive data from any accessible part of the database. The absence of proper escaping, quoting, or validation permits exploitation in applications relying on PostgreSQL drivers. This could potentially allow an attacker to utilize boolean or time-based inference methods to extract unauthorized data, thus significantly compromising application security.

References