Description
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
Remediation
References
https://nodesecurity.io/advisories/66
https://github.com/felixge/node-mysql/issues/342
Related Vulnerabilities
CVE-2020-7760 Vulnerability in npm package codemirror
CVE-2022-25885 Vulnerability in npm package hummus
CVE-2022-29577 Vulnerability in maven package org.owasp.antisamy:antisamy
CVE-2019-10350 Vulnerability in maven package org.jenkins-ci.plugins:port-allocator
CVE-2022-36092 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore