CVE-2026-76848

TypeORM's SelectQueryBuilder.distinctOn method is vulnerable due to inadequate validation of user-supplied input, allowing attackers to inject arbitrary SQL expressions into the generated query. This can lead to unauthorized data access through SQL injection, enabling attackers to infer sensitive information from the database. Organizations using TypeORM with PostgreSQL should prioritize addressing this vulnerability to protect their data integrity and confidentiality.