@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler

Description

The jsexprToSQL() function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The Literal handler wraps string values in single quotes without escaping embedded single quotes, allowing SQL injection when creating Formula-type table constraints.

Recommendation

Update the @saltcorn/data package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.6.0-alpha.0, < 1.6.0-beta.4

  >= 1.5.0, < 1.5.5

  < 1.4.5**

• Patched version(s): **1.6.0-beta.4

  1.5.5

  1.4.5**

References

• GHSA-59xv-588h-2vmm
• CWE-89
• OWASP 2021-A3

Related Issues

• @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
• Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM - Vulnerability
• Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
• Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) - CVE-2026-41478

You might also like:

These 7 PHP mistakes leave your website open to the hackers

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Tags:

npm

@saltcorn/data