HIGH

CVE-2026-19351

2026-08-09 CVSS v3.1

CVSS

7.3

Description

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.

Weakness (CWE)

CWE-74 Injection

CWE-89 SQL Injection

EPSS Score

0.4%

Probability of exploitation in next 30 days

34.4th percentile

References

https://github.com/dresende/node-sql-query/ https://github.com/dresende/node-sql-query/commit/3414c42f6de89826fa1f5f36f6139d1e6552778e https://github.com/dresende/node-sql-query/pull/64 https://github.com/dresende/node-sql-query/releases/tag/v0.1.29 https://github.com/windhxy/CVE-my/issues/2 https://vuldb.com/cve/CVE-2026-19351 https://vuldb.com/submit/865884 https://vuldb.com/vuln/387190 https://vuldb.com/vuln/387190/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE