Packages / knex / Security

HighVulnerabilityGHSA-4jv9-3563-23j3CVE-2016-20018Published 19 Dec 2022

Knex.js has a limited SQL injection vulnerability

Affected releases · knex

  • 2.x2.0.0 – 2.3.0Fixed in 2.4.0
  • 1.x and older0.0.0 – 1.0.7No fix, no longer updated

On 2.x, the newest line:

npm install knex@2.4.0
3.x

  1. Not affected

    3.0.0 – 3.3.0

    15 releases, latest

2.x

  1. Affected

    2.0.0 – 2.3.0

    4 releases

  2. Fixed

    2.4.0 – 2.5.1

    5 releases

1.x

  1. Affected

    1.0.0 – 1.0.7

    8 releases

0.x

  1. Affected

    0.0.0 – 0.95.15

    204 releases

236 stable releases of knex, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for knex. It is read in your browser and sent nowhere.

What happens

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. This vulnerability has been fixed in version 2.4.0.