CVE-2018-25066: 
JavaScript vulnerability analysis and mitigation

A critical SQL injection vulnerability was discovered in PeterMu nodebatis up to version 2.1.x. The vulnerability was disclosed on January 6, 2023, and affects the SQL builder functionality of the package. The issue was assigned identifier CVE-2018-25066 (NVD).

The vulnerability exists in the SQL builder component where user input was not properly escaped before being used in SQL queries. This could allow an attacker to inject malicious SQL commands. The issue was classified as CWE-89 (SQL Injection) (NVD CNA Status).

If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized access, data manipulation, or data exfiltration.

The vulnerability was present in the SQL builder functionality which is a core component of the nodebatis package. Any application using nodebatis versions up to 2.1.x for database operations could be vulnerable to SQL injection attacks.

The vulnerability was patched in version 2.2.0 of nodebatis. The fix includes proper escaping of SQL identifiers using the sqlstring library to prevent SQL injection (GitHub Release). Users should upgrade to version 2.2.0 or later to address this security issue.