SQL Injection in ReactPress API Endpoints via Unsanitized Query Parameter Names (CVE-2026-61685)

What happened

ReactPress API list endpoints construct TypeORM `QueryBuilder` conditions by inserting HTTP query parameter names directly into SQL as column identifiers (for example, in the pattern `article.${key}`). TypeORM parameterizes query values, but it does not parameterize column identifiers, so values that are meant to be used as query parameter keys can instead be crafted to inject SQL. This allows an unauthenticated attacker to influence the resulting SQL statement by sending crafted query string keys.

Technical cause

The root cause is improper neutralization of special elements used in SQL commands (CWE-89). Affected endpoints take the name of a query parameter from the incoming HTTP request and interpolate it directly into a SQL column reference used in a TypeORM `QueryBuilder` condition. Because TypeORM only parameterizes bound values and not identifiers such as column names, there is no automatic protection against malicious input placed in the parameter name itself.

Why it matters

The vulnerability has a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting that it can be exploited remotely over the network, requires no authentication, no user interaction, and has low attack complexity. The vector indicates a high impact on confidentiality, with no direct impact on integrity or availability as scored. This means an attacker could potentially extract sensitive data from the underlying database without needing valid credentials.

Affected versions

All versions of @fecommunity/reactpress from version 0 up to and including 3.6.0 are affected. Version 3.7.0 contains a patch that addresses this vulnerability.

Fixes and mitigation

Users should upgrade @fecommunity/reactpress to version 3.7.0, which contains a patch for this issue. As a temporary workaround, if upgrading is not immediately possible, administrators can allowlist the specific column names that are permitted to be used as filters before those names are interpolated into SQL queries, rather than accepting arbitrary parameter names from user input.

Recommended action

Site owners running @fecommunity/reactpress at version 3.6.0 or earlier should update to version 3.7.0 as soon as possible. Where immediate upgrading is not feasible, implement the documented column-name allowlist workaround to prevent unsanitized query parameter names from being used in SQL column identifiers.