SQL Injection in ReactPress API via Unsanitized Query Parameter Names

ReactPress versions 3.6.0 and earlier contain a critical SQL injection vulnerability (CVE-2026-61685) due to improper handling of dynamic column names within its API. The application uses unsanitized HTTP query parameter names directly in TypeORM QueryBuilder conditions, specifically constructing identifiers like article.${key}. While TypeORM parameterizes values, it does not parameterize column identifiers, allowing an attacker to inject SQL syntax through crafted query keys. This vulnerability affects multiple endpoints including /api/article, /api/comment, /api/file, /api/page, and /api/Knowledge. Successful exploitation allows an unauthenticated remote attacker to perform blind SQL injection, leading to the unauthorized exfiltration of sensitive data such as user credentials, system settings, and proprietary content.

Attack Chain

1. Attacker identifies a ReactPress instance exposed to the internet.
2. Attacker inspects the API structure and identifies susceptible GET endpoints (/api/article, /api/comment, /api/file, /api/page, /api/Knowledge).
3. Attacker crafts an HTTP GET request containing malicious SQL fragments within a query parameter key (e.g., ?some_col=value is replaced with ?1=1;--=value).
4. The ReactPress server parses the query parameter key and dynamically constructs a TypeORM QueryBuilder statement using the malicious key as a column identifier.
5. The resulting unsanitized query is sent to the underlying database driver.
6. The database executes the injected SQL commands alongside legitimate queries.
7. Attacker uses boolean-based or time-based blind SQL injection techniques to extract data character by character based on the server response or latency.

Impact

Successful exploitation results in unauthorized access to the application database. An attacker can exfiltrate sensitive information, including user records, system configurations, API keys, and article contents. The vulnerability is highly impactful due to its unauthenticated nature, allowing complete compromise of the database layer.

Recommendation

• Upgrade to @fecommunity/reactpress version 3.7.0 or higher immediately to patch CVE-2026-61685.
• If upgrading is not immediately possible, implement a WAF or API gateway rule to inspect and reject incoming HTTP GET requests that contain suspicious SQL syntax or illegal characters within query parameter keys.
• Implement strict allow-listing for all query parameters accepted by the API endpoints listed in this brief.