Knex.js has a limited SQL injection vulnerability

高危 7.5CVE-2016-20018 · GHSA-4jv9-3563-23j3 · Published 19/12/2022 · updated 17/06/2026

要点

CVE-2016-20018 是影响 knex (knexjs), knex 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.1%，高于 66.3% 的漏洞。
修复：升级到 2.4.0 或更高版本。

Package	Affected versions	Patched versions
knex knexjs	`≤ 2.3.0`	No fix yet
knex npm	`< 2.4.0`	`2.4.0`

Description

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. This vulnerability has been fixed in version 2.4.0.

NVD description

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.

References

nvd.nist.gov/vuln/detail/CVE-2016-20018 · ADVISORY
knex/knex · WEB
knex/knex#5417 · WEB
knex/knex commit e145322 · WEB
knex/knex · PACKAGE
knex/knex release 2.4.0 · WEB
ghostccamm.com/blog/knex_sqli · WEB
ghostccamm.com/blog/knex_sqli · Exploit

knex 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free