CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
Remote attackers can exploit SQL injection in node-sql-query to read or modify database data via manipulated request parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19351?
CVE-2026-19351 is a medium-severity SQL injection vulnerability in dresende node-sql-query, published on 9 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.
Which versions are affected by CVE-2026-19351?
How do I fix CVE-2026-19351?
No fix has been published for CVE-2026-19351 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-19351 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19351 exists.
Sources
Also known as GHSA-9hgm-6p57-h656.