GHSA-58v4-qwx5-7f59CriticalCVSS 9.8

SQL Injection in knex

Published
October 21, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-10757 →

📋 Description

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.

🎯 Affected products1

  • npm/knex:< 0.19.5

🔗 References (3)