Description

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated statement as SELECT DISTINCT ON (values), with no escaping, quoting, identifier validation or allowlist, and without routing the values through replacePropertyNames or the driver's escape helper. Because the interpolation point is a parenthesized SQL expression list rather than an identifier-only position, a supplied element may carry arbitrary expressions, including correlated subqueries. An application that forwards a client-controlled value into distinctOn, for instance to let a caller choose a deduplication column, allows that client to read data anywhere the application's database role can reach through boolean or time-based inference, independently of the entity being queried. validateOrderByCondition, the allowlist check guarding the orderBy family in the same class, is not applied to this path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T14:17:03.013Z",
  "pubdate": "2026-08-24T14:17:03.013Z",
  "executiveSummary": "TypeORM contains a critical SQL injection vulnerability within the SelectQueryBuilder.distinctOn method affecting PostgreSQL-family drivers. The vulnerability arises from improper handling of user-supplied input passed to the distinctOn function, which fails to apply validation, escaping, quoting, or allowlisting mechanisms. Consequently, an attacker capable of controlling or influencing the values passed to distinctOn can inject arbitrary SQL expressions, including correlated subqueries.\nThe primary impact of this vulnerability is unauthorized data access. If an application forwards client-controlled values directly into distinctOn—such as allowing a caller to select a deduplication column—an attacker can exploit the interpolation point within the parenthesized SQL expression list. This enables the retrieval of arbitrary data accessible by the application's database role through boolean-based or time-based inference techniques, bypassing the intended entity isolation boundaries.\nThe risk implication is severe for applications exposing query parameters dynamically. Exploitation does not require prior authentication or elevated privileges beyond what the application provides, provided the attacker can supply input to the vulnerable query builder method. Remediation requires implementing strict input validation, utilizing allowlists analogous to validateOrderByCondition, or ensuring user-supplied data is never concatenated directly into distinct clauses.",
  "technicalDetails": "The vulnerability resides in the src/query-builder/SelectQueryBuilder.ts file of TypeORM, specifically within the createSelectDistinctExpression function utilized by PostgreSQL-family drivers. When SelectQueryBuilder.distinctOn is invoked, it accepts an array of strings and stores the values directly within the expression map without performing any structural validation or sanitization.\nDuring query generation, createSelectDistinctExpression joins the stored array of strings and directly interpolates the resulting string into the generated SQL statement as SELECT DISTINCT ON (values). This interpolation occurs without quoting, identifier validation, or passing the values through replacePropertyNames or the database driver's escape helper functions. Furthermore, unlike the orderBy family of methods within the same class, the distinctOn path fails to apply validating checks such as validateOrderByCondition.\nBecause the SQL interpolation point is situated within a parenthesized SQL expression list rather than a strictly restricted identifier-only position, supplied elements are not limited to column names. An attacker can inject arbitrary SQL expressions, subqueries, or function calls. If an application dynamically maps client input to distinctOn parameters—for instance, allowing users to select columns for result deduplication—the attacker can craft a payload containing correlated subqueries.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies an application endpoint that accepts user input and passes it into the distinctOn query builder method. Second, the attacker supplies a malicious payload containing boolean or time-based SQL injection constructs or subqueries instead of a valid column name. Third, TypeORM processes the input and unsafely interpolates it directly into the SELECT DISTINCT ON (...) clause of the final query without escaping. Fourth, the database executes the resulting query containing the injected subquery. Finally, the attacker infers sensitive data based on the application's response variations, such as changes in the returned dataset structure or execution delays, thereby extracting information across unauthorized entity boundaries."
}