Failure to sanitize quotes which can lead to sql injection in squel

Description

All versions of squel are vulnerable to sql injection.

The squel package does not properly escape user provided input when provided using the setFields method. This could lead to sql injection if the query was then executed.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 5.13.0

References

• GHSA-4qhx-g9wp-g9m6
• www.npmjs.com
• CWE-74
• CWE-89
• OWASP 2021-A3

Related Issues

• beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) - CVE-2026-26226
• @langchain/community SQL Injection vulnerability - CVE-2024-7042
• Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM - Vulnerability
• Better Call routing bug can lead to Cache Deception - Vulnerability

You might also like:

These 7 PHP mistakes leave your website open to the hackers

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

5 Security Vulnerabilities You Can Fix Right Now

Tags:

npm

squel