Packages / knex / Security

CriticalVulnerabilityGHSA-58v4-qwx5-7f59CVE-2019-10757SNYK-JS-KNEX-471962Published 21 Oct 2019

SQL Injection in knex

Affected releases · knex

  • 0.19.x0.19.0 – 0.19.4Fixed in 0.19.5
  • 0.18.x and older0.0.0 – 0.18.4No fix, no longer updated

On 0.19.x, the newest line:

npm install knex@0.19.5
3.x

  1. Not affected

    3.0.0 – 3.3.0

    15 releases, latest

0.x

  1. Affected

    0.0.0 – 0.19.4

    149 releases

  2. Fixed

    0.19.5 – 0.95.15

    55 releases

236 stable releases of knex, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for knex. It is read in your browser and sent nowhere.

What happens

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.