Description
The jsexprToSQL() function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The Literal handler wraps string values in single quotes without escaping embedded single quotes, allowing SQL injection when creating Formula-type table constraints.
Recommendation
Update the @saltcorn/data package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.6.0-alpha.0, < 1.6.0-beta.4 >= 1.5.0, < 1.5.5 < 1.4.5** Patched version(s): **1.6.0-beta.4 1.5.5 1.4.5**
References
Could your website be exposed too?
SmartScanner can check your website for @saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
- Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM - Vulnerability
- Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
- Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) - CVE-2026-41478
You might also like:
See something that needs correcting? Let us knowUpdated April 10, 2026