GHSA-hx5x-49mm-vmhw
SQL Injection in sails-mysql
Versions of sails-mysql prior to 0.10.8 are vulnerable to SQL Injection. The sort keyword is not properly sanitized and may allow attackers to inject SQL statements and execute arbitrary SQL queries
Recommendation
Upgrade to version 0.10.8 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
SQL Injection in sails-mysql
Versions of sails-mysql prior to 0.10.8 are vulnerable to SQL Injection. The sort keyword is not properly sanitized and may allow attackers to inject SQL statements and execute arbitrary SQL queries
Recommendation
Upgrade to version 0.10.8 or later.
- Record
GHSA-hx5x-49mm-vmhw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
SQL Injection in sails-mysql
Versions of sails-mysql prior to 0.10.8 are vulnerable to SQL Injection. The sort keyword is not properly sanitized and may allow attackers to inject SQL statements and execute arbitrary SQL queries
Recommendation
Upgrade to version 0.10.8 or later.
- Record
GHSA-hx5x-49mm-vmhw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sails-mysqlnpm | before 0.10.8 | 0.10.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-hx5x-49mm-vmhw is a high vulnerability (CVSS 7.5) in sails-mysql, published September 3, 2020. No source lists public exploit code. Fixed in sails-mysql 0.10.8.