Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-24T13:12:03 typeorm: TypeORM: Information disclosure via SQL injection in SelectQueryBuilder.distinctOn 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-89

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated statement as SELECT DISTINCT ON (values), with no escaping, quoting, identifier validation or allowlist, and without routing the values through replacePropertyNames or the driver's escape helper. Because the interpolation point is a parenthesized SQL expression list rather than an identifier-only position, a supplied element may carry arbitrary expressions, including correlated subqueries. An application that forwards a client-controlled value into distinctOn, for instance to let a caller choose a deduplication column, allows that client to read data anywhere the application's database role can reach through boolean or time-based inference, independently of the entity being queried. validateOrderByCondition, the allowlist check guarding the orderBy family in the same class, is not applied to this path.

A flaw was found in TypeORM. The `SelectQueryBuilder.distinctOn` function, when used with PostgreSQL-family drivers, does not properly validate or escape client-controlled input. A remote attacker can exploit this vulnerability by providing malicious SQL expressions, leading to SQL injection. This allows the attacker to read sensitive data from the database that the application's database role has access to.

Red Hat Developer Hub Not affected rhdh/rhdh-hub-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-76848 https://nvd.nist.gov/vuln/detail/CVE-2026-76848 https://github.com/typeorm/typeorm https://github.com/typeorm/typeorm/blob/1.1.0/src/query-builder/SelectQueryBuilder.ts https://www.vulncheck.com/advisories/typeorm-through-sql-injection-via-selectquerybuilder-distincton