Executive brief
ReactPress is a content management API framework that exposes several list endpoints for articles, comments, files, pages, and knowledge articles. The API builds database queries using HTTP query parameter names directly as SQL column identifiers without sanitization, allowing unauthenticated attackers to inject arbitrary SQL commands. An attacker can exfiltrate sensitive data including user credentials, API keys, article content, and application settings from the underlying database.
Technical details
ReactPress API list endpoints use TypeORM QueryBuilder to dynamically construct WHERE clauses by interpolating unsanitized HTTP query parameter names directly into SQL column identifiers (e.g., `article.${key}`). While TypeORM parameterizes values, it does not parameterize column names, allowing SQL injection through crafted query string keys. Unauthenticated attackers can exploit GET endpoints (/api/article, /api/comment, /api/file, /api/page, /api/Knowledge) to perform blind SQL injection against the database. The vulnerability affects findAll() methods in multiple service files. Patched in version 3.7.0, which implements column name whitelisting before SQL interpolation.
Affected products
- FE Community ReactPress <= 3.6.0
Timeline
- 2026-06-23: disclosed: CVE-2026-61685 published by GHSA
- 2026-06-23: patched: Fixed in version 3.7.0
- 2026-09-23: advisory: GitHub Advisory Database updated