AIKIDO-2026-10225

TL;DR

Affected versions of this package contain an SQL injection vulnerability due to inconsistent escape behavior based on parameter value types. The library’s escape functions (connection.escape(), mysql.escape(), pool.escape()) handle different types (e.g., strings, numbers, objects) differently, and when non-string types such as Object are passed into parameterized queries, the resulting SQL can be altered in unexpected ways that allow an attacker to inject SQL logic and bypass intended controls. This can lead to authentication bypass and other injection impacts even in code that appears to use proper escaping. The root cause is the escape logic’s type-dependent behavior, and mitigation requires enforcing strict type handling or configuration (such as enabling stringifyObjects) before executing queries to ensure safe escaping of all input types.