DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61685: CVE-2026-61685: SQL Injection via Dynamic Query Parameters in ReactPress

#security #cve #cybersecurity

CVE-2026-61685: SQL Injection via Dynamic Query Parameters in ReactPress

Vulnerability ID: CVE-2026-61685
CVSS Score: 7.5
Published: 2026-09-23

An unauthenticated remote SQL injection vulnerability exists in multiple API list endpoints of ReactPress prior to version 3.7.0. The vulnerability stems from unsafe construction of TypeORM QueryBuilder conditions, where untrusted HTTP query parameter keys are interpolated directly into SQL statements as identifiers without sanitization or validation.

TL;DR

Unauthenticated remote SQL injection in ReactPress prior to v3.7.0 allows attackers to execute arbitrary SQL queries by tailoring query parameter keys in API requests, exposing sensitive database contents.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network (Unauthenticated)
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: 0.00535 (44.13% percentile)
  • Impact: Confidentiality: High, Integrity: None, Availability: None
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • ReactPress (fecommunity/reactpress) backend server installations running versions prior to 3.7.0
  • ReactPress: < 3.7.0 (Fixed in: 3.7.0)

Code Analysis

Commit: 78ecb70

feat: add query column whitelist to prevent SQL injection

Exploit Details

  • Advisory: Time-based blind SQL injection proof-of-concept description

Mitigation Strategies

  • Upgrade to ReactPress v3.7.0 or higher to apply strict whitelist validation.
  • Deploy Web Application Firewall (WAF) rules to inspect and sanitize HTTP query parameter keys.
  • Manually implement query key whitelist checking in the database service layer as a temporary workaround.

Remediation Steps:

  1. Verify the current installed version of ReactPress.
  2. Retrieve version 3.7.0 from the official release repository using git fetch.
  3. Checkout tag v3.7.0 and install dependencies using npm install.
  4. Rebuild and restart the NestJS server application.
  5. Verify that SQL injection payloads in query parameter keys are rejected with empty results or HTTP errors.

References

Read the full report for CVE-2026-61685 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)