Executive brief
untitled-model is a Node.js package used in application data handling. The package contains a SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized query parameters. This could lead to unauthorized data access, modification, or deletion from databases using this package.
Technical details
The vulnerability is a SQL injection (CWE-89) caused by insufficient input validation on query parameters in untitled-model. Attackers can craft malicious SQL statements and inject them through unfiltered query parameters to execute arbitrary SQL commands. The vulnerability affects all versions of the package from its initial release. No patch is currently available; users are advised to migrate to alternative packages.
Affected products
- <UNKNOWN> untitled-model all versions
Timeline
- 2020-09-11: disclosed