GitHub Advisoryadvisory · npm

GHSA-fvq6-55gv-jx9f SQL Injection in mysql

MEDIUM Published 2020-09-01 Modified 2020-08-31 Official page ↗
Aliases
CVE-2015-9244
Ecosystem
npm
Packages
mysql
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2020-08-31

Affected packages

• npm mysql: < 2.0.0-alpha8 → fixed in 2.0.0-alpha8

Description

Versions of `mysql` prior to 2.0.0-alpha8 are affected by a SQL Injection vulnerability in the `mysql.escape()` function, which does not properly escape object keys. Recommendation Update to version 2.0.0-alpha8 or later.

Related

Alias · CVE (1)

  • CVE-2015-9244 Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References