Description
knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | knex.js | All versions prior to version 0.19.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | knex | < 0.19.5 | 0.19.5 | GHSA-58v4-qwx5-7f59 |