CVE-2026-76848

A flaw was found in TypeORM. The SelectQueryBuilder.distinctOn function, when used with PostgreSQL-family drivers, does not properly validate or escape client-controlled input. A remote attacker can exploit this vulnerability by providing malicious SQL expressions, leading to SQL injection. This...

CVE-2026-76848

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-76848

...

CVE-2026-76848 TypeORM 0.2.21 through 1.1.0 SQL Injection via SelectQueryBuilder.distinctOn

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated...

CVE-2026-76848

CVE-2026-76848 targets TypeORM , specifically the SelectQueryBuilder.distinctOn function used with PostgreSQL-family drivers . The root cause is that createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins the input array and interpolates it directly into the generated SEL...

EUVD-2026-64853

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated...

CVE-2026-76848

...