The node-sql-query package is vulnerable to SQL injection, which could allow an unauthenticated attacker to manipulate database queries and compromise data integrity.

This is a SQL injection vulnerability (CWE-89) where the application fails to properly sanitize user-supplied input. The vulnerability is exploitable by an unauthenticated remote attacker.

The exploitation of this vulnerability can lead to unauthorized data exposure, modification, or deletion within the underlying database. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of applications relying on this library for query construction.

Immediate Action: Update the node-sql-query package to version 0.1.29 or later.

Proactive Monitoring: Review database query logs for anomalous syntax or unexpected patterns that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect incoming traffic for malicious payloads.

Public Exploit Available: No (no confirmed public exploit found in curated sources).

Given the high CVSS score and the ease of exploitation for SQL injection flaws, organizations should prioritize updating the node-sql-query dependency immediately. Ensuring that all database interactions are parameterized is critical to preventing this and similar injection vulnerabilities.