npm/knex CVE-2016-20018: high 7.5, EPSS 1.12%
Knex.js has a limited SQL injection vulnerability
Action: Upgrade knex to 2.4.0 or later.
npm i knex@2.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.4.0 | - |
Fixed versions
| 2.4.0 |
Sources
- osv: GHSA-4jv9-3563-23j3
- https://nvd.nist.gov/vuln/detail/CVE-2016-20018
- https://github.com/knex/knex/issues/1227
- https://github.com/knex/knex/pull/5417
- https://github.com/knex/knex/commit/e145322da92749be7749f9ade5b5f5a66d6586a4
- https://github.com/knex/knex
- https://github.com/knex/knex/releases/tag/2.4.0
- https://www.ghostccamm.com/blog/knex_sqli
CVE-2016-20018 · published · modified · JSON