Node Sql Query
Monthly
SQL injection in dresende/node-sql-query versions 0.1.25-0.1.28 allows attackers who can influence the joinType option passed to SelectQuery.from() to inject arbitrary SQL into JOIN clauses, because the joinType string was interpolated directly into the query without any allowlist validation. Applications built on this Node.js SQL query-builder library that pass user-controlled input to the joinType parameter are exploitable remotely with no authentication (per the CVSS 4.0 AV:N/PR:N vector). A publicly available exploit exists per the E:P maturity flag and referenced GitHub issue; no confirmed active exploitation (not in CISA KEV). A vendor-released patch is available as v0.1.29.
SQL injection in dresende/node-sql-query versions 0.1.25-0.1.28 allows attackers who can influence the joinType option passed to SelectQuery.from() to inject arbitrary SQL into JOIN clauses, because the joinType string was interpolated directly into the query without any allowlist validation. Applications built on this Node.js SQL query-builder library that pass user-controlled input to the joinType parameter are exploitable remotely with no authentication (per the CVSS 4.0 AV:N/PR:N vector). A publicly available exploit exists per the E:P maturity flag and referenced GitHub issue; no confirmed active exploitation (not in CISA KEV). A vendor-released patch is available as v0.1.29.