Security issue with param escaping?

Hi, im running node-mysql latest on node-latest. Somebody using the acunetix vulnerability scanner has triggered this error: UNKNOWN COLUMN '$acunetix' IN WHERE CLAUSE. The query: SELECT id, email FROM accounts WHERE username = ?

How is this possible? Its very dangerous to our application, please respond quickly.