CVE-2026-19351
Full vulnerability record from the local CVENow database.
Description
A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-09 12:16:29.457000
Last modified
2026-10-23 20:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-19351",
"sourceIdentifier": "[email protected]",
"published": "2026-08-09T12:16:29.457",
"lastModified": "2026-10-23T20:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended."
},
{
"lang": "es",
"value": "Una vulnerabilidad fue encontrada en dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Afectada por esta vulnerabilidad es la función SelectQuery.from/SelectQuery.build en la biblioteca lib/Select.js del componente Gestor de Parámetros de Solicitud. Realizar una manipulación resulta en inyección SQL. Es posible iniciar el ataque remotamente. El exploit ha sido hecho público y podría ser usado. Actualizar a la versión 0.1.29 aborda este problema. El parche se llama 3414c42f6de89826fa1f5f36f6139d1e6552778e. Actualizar el componente afectado es recomendado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "dresende",
"product": "node-sql-query",
"cpes": [
"cpe:2.3:a:dresende:node-sql-query:*:*:*:*:*:*:*:*"
],
"modules": [
"Request Parameter Handler"
],
"versions": [
{
"version": "0.1.25",
"status": "affected"
},
{
"version": "0.1.26",
"status": "affected"
},
{
"version": "0.1.27",
"status": "affected"
},
{
"version": "0.1.28",
"status": "affected"
},
{
"version": "0.1.29",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T19:35:43.774064Z",
"id": "CVE-2026-19351",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-74"
},
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://github.com/dresende/node-sql-query/",
"source": "[email protected]"
},
{
"url": "https://github.com/dresende/node-sql-query/commit/3414c42f6de89826fa1f5f36f6139d1e6552778e",
"source": "[email protected]"
},
{
"url": "https://github.com/dresende/node-sql-query/pull/64",
"source": "[email protected]"
},
{
"url": "https://github.com/dresende/node-sql-query/releases/tag/v0.1.29",
"source": "[email protected]"
},
{
"url": "https://github.com/windhxy/CVE-my/issues/2",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-19351",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/865884",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/387190",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/387190/cti",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/865884",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}