EUVD-2026-54919
GHSA-9hgm-6p57-h656
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable injection with no required auth if endpoint is public; availability impact omitted as JOIN injection primarily enables data read/write, not denial of service.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.
AnalysisAI
SQL injection in dresende/node-sql-query versions 0.1.25-0.1.28 allows attackers who can influence the joinType option passed to SelectQuery.from() to inject arbitrary SQL into JOIN clauses, because the joinType string was interpolated directly into the query without any allowlist validation. Applications built on this Node.js SQL query-builder library that pass user-controlled input to the joinType parameter are exploitable remotely with no authentication (per the CVSS 4.0 AV:N/PR:N vector). A publicly available exploit exists per the E:P maturity flag and referenced GitHub issue; no confirmed active exploitation (not in CISA KEV). A vendor-released patch is available as v0.1.29.
Technical ContextAI
node-sql-query (cpe:2.3:a:dresende:node-sql-query) is a Node.js library for programmatically building SQL SELECT, INSERT, UPDATE, and DELETE queries. The vulnerable code path is in lib/Select.js within the SelectQuery.from() and SelectQuery.build() functions. Prior to v0.1.29, the joinType option was taken from caller-supplied options and pushed directly into the SQL query string via query.push(from.opts.joinType.toUpperCase()) with no validation - a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect. The patch at commit 3414c42f introduces an explicit allowlist object (allowed_join_types) covering INNER, LEFT, LEFT OUTER, RIGHT, RIGHT OUTER, FULL, and FULL OUTER; any value not in that map throws an Error before query construction proceeds. The PR diff also corrects invalid SQL in the documentation (LEFT INNER is not a valid ANSI JOIN type; the fix replaces it with LEFT OUTER throughout tests and README).
RemediationAI
Upgrade node-sql-query to v0.1.29, the vendor-released patched version. The fix is delivered via commit 3414c42f6de89826fa1f5f36f6139d1e6552778e and is available as a tagged release at https://github.com/dresende/node-sql-query/releases/tag/v0.1.29 and merged via pull request at https://github.com/dresende/node-sql-query/pull/64. As a compensating control prior to upgrading, applications should validate the joinType value against an explicit allowlist (INNER, LEFT, LEFT OUTER, RIGHT, RIGHT OUTER, FULL, FULL OUTER) before passing it to SelectQuery.from(); this can be done at the application layer with minimal trade-offs, though it places the burden of sanitization on consumer code rather than the library. Do not pass unsanitized request parameters to joinType under any circumstances.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today