Description

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-09T12:16:29.457Z",
  "pubdate": "2026-08-09T12:16:29.457Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the dresende node-sql-query library across versions 0.1.25, 0.1.26, 0.1.27, and 0.1.28. The flaw exists within the Request Parameter Handler component, specifically inside the SelectQuery.from and SelectQuery.build functions located in lib/Select.js. This vulnerability allows remote attackers to manipulate input parameters, leading to the execution of arbitrary SQL commands against the underlying database. The risk implication is severe, as successful exploitation could compromise the confidentiality, integrity, and availability of the database system. Public exploits for this vulnerability are currently available, increasing the likelihood of active targeting. Remediation requires updating the affected component to version 0.1.29, which incorporates the official security patch identified by commit hash 3414c42f6de89826fa1f5f36f6139d1e6552778e.",
  "technicalDetails": "The vulnerability resides in the request parameter handling logic of the dresende node-sql-query library, specifically within the SelectQuery.from and SelectQuery.build functions implemented in lib/Select.js. The root cause of the vulnerability is the improper neutralization of user-supplied input before it is concatenated or interpolated directly into dynamically constructed SQL query strings. Because the library fails to adequately sanitize or parameterize inputs passed to the query builder, an attacker can supply specially crafted payloads designed to break out of the intended SQL syntax context.\nExploitation of this vulnerability can be performed remotely without requiring prior authentication or elevated privileges. An attacker initiates the attack by sending maliciously crafted parameters to the application endpoints that utilize the vulnerable SelectQuery methods. When the request parameter handler processes the input, the unsanitized data is incorporated into the SQL statement during query construction. Consequently, the database engine interprets the injected payload as valid SQL commands, enabling the execution of arbitrary database queries.\nThe attack flow proceeds as follows: First, the attacker identifies an application input vector that relies on the vulnerable dresende node-sql-query functions for database interaction. Second, the attacker crafts an exploit payload containing SQL syntax manipulation characters. Third, the remote request is transmitted to the server, where the vulnerable lib/Select.js component processes the input without adequate validation. Finally, the resulting SQL query containing the malicious payload is executed by the database management system, potentially resulting in unauthorized data access, data modification, or database compromise depending on the privileges of the database connection."
}