DailyCVE@dailycve
🔴 ReactPress, SQL Injection, #CVE-2026-61685 (High) -DC-Sep2026-2556 https://dailycve.com/reactpress-sql-injection-cve-2026-61685-high-dc-sep2026-2556/
0000027
236 followersView on X
CVE-2026-61685
LOWCVSS 7.5 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-89
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day