Read the docs
TI-2018-15293 Aliases CVE-2018-25066GHSA-8ph8-9q2j-c3rq

PeterMu nodebatis sql injection

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

A vulnerability was found in PeterMu nodebatis up to 2.1.x. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 6629ff5b7e3d62ad8319007a54589ec1f62c7c35. It is recommended to upgrade the affected component. VDB-217554 is the identifier assigned to this vulnerability.

Why it matters now

EPSS 0.0074 54th percentileScored 2026-11-07
Fix Fixed nodebatis (npm): 2.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PeterMunodebatis2.0; 2.1—No fix listedCNA
—nodebatis (npm)before 2.2.02.2.0Patch availableGHSA-8ph8-9q2j-c3rq
  • nodebatis VendorPeterMu Affected 2.0; 2.1 Fixed in — No fix listed CNA
  • nodebatis (npm) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-8ph8-9q2j-c3rq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodebatis_project:nodebatis:*:*:*:*:*:*:*:*before 2.2.0VulnerableNodebatis Project
  • cpe:2.3:a:nodebatis_project:nodebatis:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·Nodebatis Project

Remediation

  • Fix · GHSA-8ph8-9q2j-c3rq nodebatis (npm) Fixed in 2.2.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-25066
  2. 2026-10-03 Alias added: GHSA-8ph8-9q2j-c3rq

References

Patch 2

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences