@payloadcms/db-d1-sqlite 3.89.0

Direct Vulnerabilities

Known vulnerabilities in the @payloadcms/db-d1-sqlite package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H SQL Injection @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in `parseParams` when constructing JSON queries for `in` and `not_in` operators. An authenticated attacker can supply a string value containing a single-quote character in a query parameter to break out of the intended SQL literal context and inject arbitrary SQL, achieving full read and write access to the database. How to fix SQL Injection? Upgrade `@payloadcms/db-d1-sqlite` to version 3.90.0, 4.0.0-canary.34 or higher.	<3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
H SQL Injection @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the `convertPathToJSONTraversal` function in SQLite JSON query construction, where user-controlled JSON path segments are interpolated into SQL expressions without sufficient sanitization. An authenticated attacker can supply a malicious path segment to inject arbitrary SQL, enabling unauthorized read and write access to database contents. How to fix SQL Injection? Upgrade `@payloadcms/db-d1-sqlite` to version 3.90.0, 4.0.0-canary.34 or higher.	<3.90.0>=4.0.0-canary.0 <4.0.0-canary.34

Vulnerability

Vulnerable Version

SQL Injection

@payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload

Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and not_in operators. An authenticated attacker can supply a string value containing a single-quote character in a query parameter to break out of the intended SQL literal context and inject arbitrary SQL, achieving full read and write access to the database.

How to fix SQL Injection?

Upgrade @payloadcms/db-d1-sqlite to version 3.90.0, 4.0.0-canary.34 or higher.

<3.90.0>=4.0.0-canary.0 <4.0.0-canary.34

SQL Injection

@payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload

Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are interpolated into SQL expressions without sufficient sanitization. An authenticated attacker can supply a malicious path segment to inject arbitrary SQL, enabling unauthorized read and write access to database contents.

How to fix SQL Injection?

Upgrade @payloadcms/db-d1-sqlite to version 3.90.0, 4.0.0-canary.34 or higher.

<3.90.0>=4.0.0-canary.0 <4.0.0-canary.34

@payloadcms/db-d1-sqlite@3.89.0

The officially supported D1 SQLite database adapter for Payload

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically