knex@0.6.5 vulnerabilities

A batteries-included SQL query & schema builder for PostgresSQL, MySQL, CockroachDB, MSSQL and SQLite3

Known vulnerabilities in the knex package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H SQL Injection knex is a query builder for PostgreSQL, MySQL and SQLite3 Affected versions of this package are vulnerable to SQL Injection due to missing escape of field objects, which allows ignoring the `WHERE` clause of a `SQL` query. Note: Exploiting this vulnerability is possible when using `MySQL` DB. How to fix SQL Injection? Upgrade `knex` to version 2.4.0 or higher.	<2.4.0
C SQL Injection knex is a query builder for PostgreSQL, MySQL and SQLite3 Affected versions of this package are vulnerable to SQL Injection. None How to fix SQL Injection? Upgrade `knex` to version 0.19.5 or higher.	<0.19.5
M SQL Injection `knex` is a batteries-included SQL query & schema builder for Postgres, MySQL and SQLite3 and the Browser. Column names are not properly escaped in the postgreSQL dialect. This may allow attackers to craft a query to the host DB and access private information. Writing the following code: `var query = knex.select('id","name').from('test') console.log(query.toSQL())` Has the following result: `{ method: 'select', options: undefined, bindings: [], sql: 'select "id","name" from "test"' }` How to fix SQL Injection? Upgrade `knex` to versions `0.6.23`, `0.7.6` or higher.	<0.6.23 >=0.7.0 <0.7.6