Description
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
Remediation
References
https://github.com/felixge/node-mysql/issues/342
https://nodesecurity.io/advisories/66
Related Vulnerabilities
CVE-2021-44908 Vulnerability in npm package sails
CVE-2023-4316 Vulnerability in npm package zod
CVE-2021-32824 Vulnerability in maven package org.apache.dubbo:dubbo-common
CVE-2014-3603 Vulnerability in maven package org.opensaml:opensaml
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-parent