CVE-2019-10757

PoC —

CVSS 3.1

9.8 critical

EPSS

1%p65

Published

Oct 8, 2019 (Oct 8, 2019)

Modified

Jun 17, 2026

Description

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.

Vendors: knexjs
Products: knex
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.