Executive brief
The sql npm package fails to properly escape parameters when building SQL queries, allowing attackers to inject arbitrary SQL code. Applications using this library to construct database queries are vulnerable to data theft, modification, or deletion. The library maintainers have not released a fix; users are advised not to install or use this module.
Technical details
This is a SQL injection vulnerability (CWE-89) in the sql npm package affecting all versions up to and including 0.78.0. The library does not properly sanitize or escape user-supplied parameters when building SQL query strings, allowing an attacker to inject malicious SQL syntax. The attack requires an application to pass untrusted input to the library's query-building functions. A successful exploit can result in unauthorized database access, data exfiltration, or modification of database contents. No patch is currently available; the advisory recommends discontinuing use of this package.
Affected products
- npm sql 0 through 0.78.0
Timeline
- 2019-06-12: disclosed: GHSA advisory published