GHSA-4qhx-g9wp-g9m6
Failure to sanitize quotes which can lead to sql injection in squel
GHSA-4qhx-g9wp-g9m6 is a vulnerability with no CVSS score yet in squel, published June 14, 2019. No source lists public exploit code. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
All versions of squel are vulnerable to sql injection.
The squel package does not properly escape user provided input when provided using the setFields method. This could lead to sql injection if the query was then executed.
Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.
> console.log(squel.insert().into('buh').setFields({foo: "bar'baz"}).toString());
INSERT INTO buh (foo) VALUES ('bar'baz')
Recommendation
There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squelnpm | through 5.13.0 | None known |
What each source reports
GitHub AdvisoriesNo score
Failure to sanitize quotes which can lead to sql injection in squel
All versions of squel are vulnerable to sql injection.
The squel package does not properly escape user provided input when provided using the setFields method. This could lead to sql injection if the query was then executed.
Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.
> console.log(squel.insert().into('buh').setFields({foo: "bar'baz"}).toString());
INSERT INTO buh (foo) VALUES ('bar'baz')
Recommendation
There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.
- Record
GHSA-4qhx-g9wp-g9m6- Weakness
- CWE-74, CWE-89
- Updated
- 2026-11-02
OSVNo score
Failure to sanitize quotes which can lead to sql injection in squel
All versions of squel are vulnerable to sql injection.
The squel package does not properly escape user provided input when provided using the setFields method. This could lead to sql injection if the query was then executed.
Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.
> console.log(squel.insert().into('buh').setFields({foo: "bar'baz"}).toString());
INSERT INTO buh (foo) VALUES ('bar'baz')
Recommendation
There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.
- Record
GHSA-4qhx-g9wp-g9m6- Weakness
- CWE-74, CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.