SQL Injection Affecting smoosense package, versions [,0.1.17)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-SMOOSENSE-14171920
- published4 Dec 2025
- disclosed2 Dec 2025
- creditUnknown
Introduced: 2 Dec 2025
New CVE NOT AVAILABLE CWE-89 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade smoosense to version 0.1.17 or higher.
Overview
smoosense is a Smoothly make sense of your large multi-modal datasets
Affected versions of this package are vulnerable to SQL Injection via improper handling of user-supplied filter values. The parseFilters.ts and helpers.ts utility functions fail to escape single quotes before incorporating filter input into SQL LIKE clauses, allowing an attacker to supply malicious values that break query structure and inject arbitrary SQL commands.