Description
knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
Remediation
References
https://snyk.io/vuln/SNYK-JS-KNEX-471962
Related Vulnerabilities
CVE-2020-28452 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.12
CVE-2020-28429 Vulnerability in npm package geojson2kml
CVE-2022-21718 Vulnerability in maven package org.webjars.npm:electron
CVE-2021-23327 Vulnerability in npm package apexcharts
CVE-2020-36188 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind