{"id":"CVE-2026-61685","title":"ReactPress is a publishing system for React developers","summary":"ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `articl…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-89"],"vendor":"fecommunity","product":"reactpress","affected":["reactpress < 3.7.0"],"published":"2026-09-22","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:12:04.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61685","references":[{"url":"https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6","label":"security-advisories@github.com"},{"url":"https://github.com/fecommunity/reactpress/releases/tag/v3.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61685"},{"url":"https://github.com/advisories/GHSA-wmw4-mw6x-6vfm"}],"tags":["nvd","cve.org","ghsa","npm"],"epss":0.00535,"epssPercentile":0.44975,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-23T14:15:08.713780Z"},"ingestedAt":"2026-09-23T00:14:05.312Z","aliases":["GHSA-wmw4-mw6x-6vfm"],"ecosystem":"npm","patched":["@fecommunity/reactpress 3.7.0"],"slug":"CVE-2026-61685","body":"## Overview\n\nReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61685)\n\nAffected packages:\n\n- `@fecommunity/reactpress <= 3.6.0`\n\nPatched in:\n\n- `@fecommunity/reactpress 3.7.0`\n\nSource: https://github.com/advisories/GHSA-wmw4-mw6x-6vfm","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}