CVE-2026-19351

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19351
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19351.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19351
Published
2026-08-09T11:30:10.583Z
Modified
2026-08-12T03:51:17.693582222Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
Details

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.

Database specific 
{
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19351.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/dresende/node-sql-query

Affected ranges

Type
GIT
Repo
https://github.com/dresende/node-sql-query
Events
Introduced
5dfae4d7da3f1112ed165031e5b24a562a325a20
Fixed
3414c42f6de89826fa1f5f36f6139d1e6552778e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.25"
        },
        {
            "last_affected": "0.1.25"
        },
        {
            "introduced": "0.1.26"
        },
        {
            "last_affected": "0.1.26"
        },
        {
            "introduced": "0.1.27"
        },
        {
            "last_affected": "0.1.27"
        },
        {
            "introduced": "0.1.28"
        },
        {
            "last_affected": "0.1.28"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.25
0.1.26
0.1.27
0.1.28
v0.*
v0.1.25
v0.1.26
v0.1.28

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19351.json"