All versions of
query-mysql are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database.
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is passed into this module.
publishedAdvisory publishedMay 16th, 2018
reportedInitial report by bl4deMay 16th, 2018