The library node-sql-query builds SQL statements from request parameters via the SelectQuery.build function. A flaw in handling these parameters allows an attacker to inject arbitrary SQL because the function does not properly escape or parameterize user input. This weakness, classified as CWE-74 and CWE-89, can compromise the confidentiality and integrity of the underlying database, enabling a remote adversary to execute arbitrary queries, exfiltrate data, or modify records.

The vulnerability affects the dresende node-sql-query library, specifically versions 0.1.25 through 0.1.28. The package is identified as dresende:node-sql-query in the CPE namespace. Upgrading to version 0.1.29 or later resolves the issue.

The CVSS v3.1 score of 6.9 indicates moderate severity, and no EPSS score is available, but the exploit has been made public and is remotely exploitable, meaning attackers already possess proven code to trigger the injection. The vulnerability is not listed in the CISA KEV catalog, yet the existence of a public exploit and the remote nature of the attack vector increase risk. The typical attack scenario involves sending a crafted HTTP request containing malicious input to the endpoint that invokes SelectQuery.build.