CVE-2026-76848

Name of the Vulnerable Software and Affected Versions TypeORM versions 0.2.21 through 1.1.0

Description TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, the createSelectDistinctExpression() function in src/query-builder/SelectQueryBuilder.ts joins this array and interpolates the result into the generated statement as SELECT DISTINCT ON (values). This process occurs without escaping, quoting, identifier validation, or an allowlist, and bypasses the driver's escape helper and replacePropertyNames. Since the interpolation point is a parenthesized SQL expression list, an attacker can provide arbitrary expressions, including correlated subqueries. If an application passes client-controlled values into distinctOn, it allows the client to read data accessible to the application's database role through boolean or time-based inference, regardless of the entity being queried. This path is not protected by the validateOrderByCondition allowlist check used by the orderBy family.

Recommendations Update TypeORM to a version later than 1.1.0. As a temporary workaround, avoid passing client-controlled values into the distinctOn method of SelectQueryBuilder.