GitHub Advisoryadvisory · npm

GHSA-8f93-rv4p-x4jw SQL Injection in sql

MEDIUM Published 2019-06-12 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
sql
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2019-06-12

Affected packages

• npm sql: <= 0.78.0 (no fix yet)

Description

All versions of `sql` are vulnerable to sql injection as it does not properly escape parameters when building SQL queries. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References