Description
Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | knex | < 2.4.0 | 2.4.0 | GHSA-4jv9-3563-23j3 |
High · 7.5
CVE-2016-20018
EUVD-2022-7505GHSA-4jv9-3563-23j3
Knex.js has a limited SQL injection vulnerability
Published Dec 19, 2022 · Updated Aug 6, 2024 · Assigned by mitre