[Security] SQL Injection via JSON default values in formatDefault() (CWE-89)

Security Vulnerability Report

Discovered by: SuyZ (UIT — University of Information Technology, Ho Chi Minh City)

I've discovered a SQL injection vulnerability in formatDefault() when handling JSON default values. The function uses JSON.stringify() output directly in SQL string literals without escaping single quotes, enabling injection across multiple database dialects.

CWE-89 | Affects: MSSQL (critical — file read via OPENROWSET), SQLite, MySQL, PostgreSQL

I have a complete PoC with 4-dialect proof. Since this repo has no SECURITY.md or private vulnerability reporting enabled, I'm creating this limited-disclosure issue.

Please enable GitHub Private Vulnerability Reporting so I can share the full technical details and PoC privately. Alternatively, please provide a security contact email.

The vulnerability is in the DDL/schema migration path, not in normal query building.

I'm happy to provide the full report, PoC code, and suggested fix privately.