Skip to content
OpenAdvisories

Product · fecommunity

reactpress

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-61685

    ReactPress has SQL injection via dynamic column names in TypeORM query builders

    ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM…

    fecommunity reactpress @fecommunity/reactpress npm