CVE-2026-47387: Knex Raw Dynamic Value Injection
Detected the direct injection of a dynamic object property (such as an AST node's `.value`) as the first argument to `knex.raw()`. This bypasses query parameterization and enables SQL injection if the property holds user-controlled data. The first argument of `knex.raw()` must be a static SQL string. Dynamic user inputs must be passed safely via the second a
TSgreprules fetch cve-2026-47387-knex-raw-dynamic-value-injection --engine opengrepDescription
Detected the direct injection of a dynamic object property (such as an AST node's `.value`) as the first argument to `knex.raw()`. This bypasses query parameterization and enables SQL injection if the property holds user-controlled data. The first argument of `knex.raw()` must be a static SQL string. Dynamic user inputs must be passed safely via the second a
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0