Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Published: 2026-08-24
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade TypeORM to a release newer than 1.1.0 where distinctOn input is validated and properly escaped.
  • Remove or sanitize any code paths that pass user input directly to SelectQueryBuilder.distinctOn, ensuring only trusted column names are allowed.
  • Apply an explicit whitelist check for distinctOn arguments, mirroring the validateOrderByCondition logic used for orderBy clauses, to defend against injection.

Generated by OpenCVE AI on August 24, 2026 at 17:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title TypeORM 0.2.21 through 1.1.0 SQL Injection via SelectQueryBuilder.distinctOn typeorm: TypeORM: Information disclosure via SQL injection in SelectQueryBuilder.distinctOn
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Thu, 03 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Description TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated statement as SELECT DISTINCT ON (values), with no escaping, quoting, identifier validation or allowlist, and without routing the values through replacePropertyNames or the driver's escape helper. Because the interpolation point is a parenthesized SQL expression list rather than an identifier-only position, a supplied element may carry arbitrary expressions, including correlated subqueries. An application that forwards a client-controlled value into distinctOn, for instance to let a caller choose a deduplication column, allows that client to read data anywhere the application's database role can reach through boolean or time-based inference, independently of the entity being queried. validateOrderByCondition, the allowlist check guarding the orderBy family in the same class, is not applied to this path. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CPEs cpe:2.3:a:typeorm:typeorm:*:*:*:*:*:*:*:*
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 24 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Description TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated statement as SELECT DISTINCT ON (values), with no escaping, quoting, identifier validation or allowlist, and without routing the values through replacePropertyNames or the driver's escape helper. Because the interpolation point is a parenthesized SQL expression list rather than an identifier-only position, a supplied element may carry arbitrary expressions, including correlated subqueries. An application that forwards a client-controlled value into distinctOn, for instance to let a caller choose a deduplication column, allows that client to read data anywhere the application's database role can reach through boolean or time-based inference, independently of the entity being queried. validateOrderByCondition, the allowlist check guarding the orderBy family in the same class, is not applied to this path.
Title TypeORM 0.2.21 through 1.1.0 SQL Injection via SelectQueryBuilder.distinctOn
First Time appeared Typeorm
Typeorm typeorm
Weaknesses CWE-89
CPEs cpe:2.3:a:typeorm:typeorm:*:*:*:*:*:*:*:*
Vendors & Products Typeorm
Typeorm typeorm
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Typeorm Typeorm
cve-icon MITRE

Status: REJECTED

Assigner: VulnCheck

Published:

Updated: 2026-09-03T14:58:02.799Z

Reserved: 2026-08-19T20:34:19.724Z

Link: CVE-2026-76848

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-24T14:17:03.013

Modified: 2026-09-03T15:17:33.633

Link: CVE-2026-76848

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-24T13:12:03Z

Links: CVE-2026-76848 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T17:15:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')