Description
waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`, or `endsWith` will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | waterline-sequel node module | 0.5.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | waterline-sequel | < 0.5.1 | 0.5.1 | GHSA-cgpp-wm2h-6hqx |