CVE-2026-61685: 
JavaScript 취약성 분석 및 완화

CVE-2026-61685 is a SQL injection vulnerability in ReactPress, a publishing system for React developers, affecting all versions up to and including 3.6.0 of the @fecommunity/reactpress npm package. The flaw was first published by the vendor on June 23, 2026, and subsequently published to the National Vulnerability Database on September 22, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause (CWE-89) lies in how ReactPress API list endpoints construct TypeORM QueryBuilder conditions: HTTP query parameter names are interpolated directly into SQL column identifiers using template literals such as `article.${key}` without any sanitization or allowlisting (Github Advisory). While TypeORM parameterizes query values, it does not sanitize column names, so an attacker can craft malicious query string keys to alter the generated SQL. The vulnerability is exploitable by unauthenticated attackers via simple HTTP GET requests — no credentials, special configuration, or user interaction are required. Affected service files include article.service.ts, comment.service.ts, file.service.ts, page.service.ts, and knowledge.service.ts (Patch Commit).

Successful exploitation enables unauthenticated remote attackers to perform blind SQL injection against the application's database, potentially exfiltrating sensitive data including user records, application settings, API keys, and article content (Github Advisory). The CVSS scoring reflects a high confidentiality impact with no integrity or availability impact, meaning the primary risk is unauthorized data disclosure rather than data modification or service disruption. All five public-facing API endpoints (GET /api/article, GET /api/comment, GET /api/file, GET /api/page, GET /api/Knowledge) are affected, broadening the attack surface across the entire application (Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is classified as automatable (no user interaction required) with a partial technical impact per NVD SSVC assessment. The EPSS score is approximately 0.535%, placing it in the 44th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing ReactPress instances running versions ≤ 3.6.0 using search engines or tools like Shodan/Censys, looking for the default API prefix /api and characteristic ReactPress response headers.
2. Identify vulnerable endpoints: Target any of the unauthenticated GET endpoints: /api/article, /api/comment, /api/file, /api/page, or /api/Knowledge.
3. Craft malicious query parameter name: Construct an HTTP GET request where the key of a query parameter contains SQL injection syntax. For example: GET /api/article?title=test&1=1 UNION SELECT ...--=value — the key itself (not the value) is injected into the SQL column identifier.
4. Perform blind SQL injection: Since TypeORM parameterizes values but not column names, the injected key is interpolated into the query as article.1=1 UNION SELECT ... allowing boolean-based or time-based blind SQL injection to enumerate database schema and extract data.
5. Exfiltrate data: Use automated tools (e.g., sqlmap with a custom tamper targeting parameter names) to systematically extract user credentials, API keys, settings, and content from the database (Github Advisory, Patch Commit).

• Network: Unusual GET requests to /api/article, /api/comment, /api/file, /api/page, or /api/Knowledge with query parameter names containing SQL keywords (e.g., UNION, SELECT, AND, OR, --, SLEEP, BENCHMARK) or special characters (backticks, quotes, semicolons).
• Logs: Web/application server access logs showing repeated requests to the above endpoints with abnormal or encoded query string keys; time-delayed responses suggesting time-based blind SQL injection (e.g., responses taking several seconds longer than baseline).
• Logs: Database query logs (if enabled) showing dynamically constructed SQL with unexpected column identifiers or SQL keywords embedded in column name positions.
• Process: Unusual database activity such as large sequential reads, schema enumeration queries (information_schema), or queries against tables unrelated to normal application operation.

Upgrade to @fecommunity/reactpress version 3.7.0 or later, which introduces a filterByWhitelist() utility that validates query parameter names against a per-entity allowlist of permitted column names before interpolating them into SQL (v3.7.0 Release, Patch Commit). As a temporary workaround for those unable to upgrade immediately, implement an allowlist of permitted filter column names in each findAll() method before interpolating any query parameter key into a TypeORM QueryBuilder condition (Github Advisory). Additionally, consider placing a WAF rule to block requests with SQL keywords in query parameter names as a defense-in-depth measure.