GHSA-crhg-xgrg-vvcc

a12nserver vulnerable to potential SQL Injections via Knex dependency

6.5 MediumFix available

Impact

Users of a12nserver that use MySQL might be vulnerable to SQL injection bugs.

If you use a12nserver and MySQL, update as soon as possible. This SQL injection bug might let an attacker obtain OAuth2 Access Tokens for users unrelated to those that permitted OAuth2 clients.

Patches

The knex dependency has been updated to 2.4.0 in a12nserver 0.23.0

Workarounds

No further workarounds

References

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

What each source reports

GitHub Advisories Score used6.5

a12nserver vulnerable to potential SQL Injections via Knex dependency

Impact

Users of a12nserver that use MySQL might be vulnerable to SQL injection bugs.

If you use a12nserver and MySQL, update as soon as possible. This SQL injection bug might let an attacker obtain OAuth2 Access Tokens for users unrelated to those that permitted OAuth2 clients.

Patches

The knex dependency has been updated to 2.4.0 in a12nserver 0.23.0

Workarounds

No further workarounds

References

Record: GHSA-crhg-xgrg-vvcc
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-89
Updated: 2026-11-02

OSV6.5

a12nserver vulnerable to potential SQL Injections via Knex dependency

Impact

Users of a12nserver that use MySQL might be vulnerable to SQL injection bugs.

If you use a12nserver and MySQL, update as soon as possible. This SQL injection bug might let an attacker obtain OAuth2 Access Tokens for users unrelated to those that permitted OAuth2 clients.

Patches

The knex dependency has been updated to 2.4.0 in a12nserver 0.23.0

Workarounds

No further workarounds

References

Record: GHSA-crhg-xgrg-vvcc
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-89
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`@curveball/a12n-server` npm	0.20.0 up to 0.23.0	0.23.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-crhg-xgrg-vvcc is a medium vulnerability (CVSS 6.5) in @curveball/a12n-server, published January 13, 2023. No source lists public exploit code. Fixed in @curveball/a12n-server 0.23.0.