CVE-2019-10757

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.

Score

CVSS 3.1 9.8 Critical

Status

Modified - report@snyk.io

Published

2019-10-08

Last modified

2024-08-04

Weaknesses

CWE-89

Affected products

• Knex (Knexjs)

References

• https://snyk.io/vuln/SNYK-JS-KNEX-471962